Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
prop-types npm: Security Review and Safe Usage
The prop-types npm package is a runtime type checker React split out years ago. React 19 stopped honoring propTypes internally, which changes when and why you should still depend on it.
How Do You Create an npm Module Securely?
To create an npm module you need package.json, a clear entry point, and a publish step, but doing it safely means locking down metadata, tokens, and what actually ships. Here is the full walkthrough.
Is react-native-gesture-handler Safe? An npm Security Review
react-native-gesture-handler is a core, actively maintained library, but any native module changes your app's trust and update calculus. Here is the security review.
shortid Is Deprecated: Why It Is Unsafe for IDs and What to Use Instead
The shortid npm package is deprecated by its own maintainers because the architecture is unsafe. Here is what is actually wrong with it and how to migrate to nanoid without breaking existing IDs.
react-grid-layout: Package Health and Production Considerations
A production-focused review of the react-grid-layout npm package: what it does well, its maintenance profile, performance traps, and how to depend on it responsibly.
com.google.code.gson: Using Gson Safely in Modern Java
Why the com.google.code.gson group ID looks so odd, what maintenance mode means for the library, and the configuration habits that keep Gson safe in modern Java services.
Is the DOMPurify npm Package Safe? CVEs and Secure Usage
DOMPurify (npm) is the right tool for sanitizing HTML against XSS, and it is safe when you keep it patched - but it has had real bypass CVEs, so version discipline matters.
How to Create an npm Package in TypeScript Safely
A practical walkthrough to create an npm package in TypeScript, plus the supply-chain hardening steps most tutorials skip: provenance, dependency hygiene, and safe publishing.
fork-ts-checker-webpack-plugin: A Security-Minded Guide
The fork-ts-checker-webpack-plugin speeds up TypeScript builds by moving type checking off the main thread, and treating it as a build-time dependency has real security implications.
prism-react-renderer: Safe Syntax Highlighting in React
prism-react-renderer gives you tokenized syntax highlighting in React without dangerouslySetInnerHTML. Here is how it works, why that matters for XSS, and how to keep the dependency healthy.
nyc on npm: A Security Review and Safe Usage Guide
nyc is the Istanbul command-line coverage tool for Node.js. Here is its security profile and how to run it without leaking source or slowing your pipeline.
tinymce-angular Security: What to Know Before You Ship
The tinymce-angular wrapper is thin, but it ships a full rich-text editor whose sanitization gaps have produced real XSS CVEs. Here is how to use it safely.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.