dependencies
Safeguard articles tagged "dependencies" — guides, analysis, and best practices for software supply chain and application security.
65 articles
What Is Software Composition Analysis (SCA)?
Software Composition Analysis (SCA) identifies the open source and third-party components in your code, then flags their known vulnerabilities and license risks. Here's how SCA works and what separates modern tools from legacy scanners.
SBOM vs SCA: What's the Difference?
An SBOM is a list of what's in your software. SCA is the practice of analyzing that list for risk. One is an artifact; the other is an activity.
Is Lodash Safe? A 2026 Security Guide
Lodash powers a huge slice of the JavaScript ecosystem — and a string of prototype pollution and injection CVEs have made 'is lodash safe' a real question. Here is the honest answer for 2026.
npm audit: The Complete Guide to Auditing Node.js Dependencies
How npm audit really works, the exact commands to run in CI, where it silently falls short, and how to close the gaps with reachability-aware SCA and autonomous fixes.
Introduction to Software Supply Chain Security
Modern software is assembled from far more code than any one team writes. Software supply chain security protects every dependency, build tool, and pipeline that goes into the finished product. Here is the foundational picture.
Auditing Python Dependencies with pip-audit: A Practical Guide
pip-audit is the PyPA-backed tool for scanning Python dependencies against the OSV and PyPI advisory databases. Here is how to run it well — and where it needs backup.
How to Check if an npm Package Is Safe
Before you run npm install, learn a quick, repeatable routine to judge whether an npm package is trustworthy — using metadata, known vulnerabilities, and a scan.
TensorFlow Security Guide (2026)
TensorFlow is one of the most widely deployed machine-learning frameworks — and its history of model-deserialization RCE and crafted-tensor memory bugs makes its version and loading habits genuinely security-relevant.
Is Java Safe? A Realistic Look at Java Security in 2025
Is Java safe? The language has strong built-in protections, but real Java risk lives in dependencies, deserialization, and configuration. Here is the honest picture.
Is react-spinners Safe? A Supply Chain Look at the npm Package
react-spinners is a popular zero-dependency loading component library for React. Here is an honest look at what it is and how to keep small npm dependencies safe.
react-slick: Security and Maintenance Guide for 2025
react-slick is a hugely popular carousel component with no known CVEs, but slowing maintenance and its dependency chain are the risks worth watching before you adopt it.
Is python-docx Safe? A Security Guide
python-docx reads and writes Word documents in Python. Here is what its security posture actually depends on, especially when you open files you did not create.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.