Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
shortid Is Deprecated: Why It Is Unsafe for IDs and What to Use Instead
The shortid npm package is deprecated by its own maintainers because the architecture is unsafe. Here is what is actually wrong with it and how to migrate to nanoid without breaking existing IDs.
react-grid-layout: Package Health and Production Considerations
A production-focused review of the react-grid-layout npm package: what it does well, its maintenance profile, performance traps, and how to depend on it responsibly.
com.google.code.gson: Using Gson Safely in Modern Java
Why the com.google.code.gson group ID looks so odd, what maintenance mode means for the library, and the configuration habits that keep Gson safe in modern Java services.
Is the DOMPurify npm Package Safe? CVEs and Secure Usage
DOMPurify (npm) is the right tool for sanitizing HTML against XSS, and it is safe when you keep it patched - but it has had real bypass CVEs, so version discipline matters.
How to Create an npm Package in TypeScript Safely
A practical walkthrough to create an npm package in TypeScript, plus the supply-chain hardening steps most tutorials skip: provenance, dependency hygiene, and safe publishing.
fork-ts-checker-webpack-plugin: A Security-Minded Guide
The fork-ts-checker-webpack-plugin speeds up TypeScript builds by moving type checking off the main thread, and treating it as a build-time dependency has real security implications.
prism-react-renderer: Safe Syntax Highlighting in React
prism-react-renderer gives you tokenized syntax highlighting in React without dangerouslySetInnerHTML. Here is how it works, why that matters for XSS, and how to keep the dependency healthy.
nyc on npm: A Security Review and Safe Usage Guide
nyc is the Istanbul command-line coverage tool for Node.js. Here is its security profile and how to run it without leaking source or slowing your pipeline.
tinymce-angular Security: What to Know Before You Ship
The tinymce-angular wrapper is thin, but it ships a full rich-text editor whose sanitization gaps have produced real XSS CVEs. Here is how to use it safely.
Vitest on npm: A Security Review Before You Add It
Vitest is a fast Vite-native test runner, but its API and browser-mode servers have a real security footprint. Here is what to check before adding vitest from npm.
How to Check for npm Vulnerabilities (and Actually Fix Them)
npm check vulnerabilities the right way: what npm audit tells you, where it misleads, and how to turn a wall of advisories into a short list of things worth fixing.
How to Secure webpack-dev-server Against Source Code Theft
webpack-dev-server is a local development server, not a production one, and two 2025 CVEs showed exactly why that distinction matters. Here is how it leaks and how to lock it down.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.