dependencies
Safeguard articles tagged "dependencies" — guides, analysis, and best practices for software supply chain and application security.
74 articles
Bounty Program Scoping for Dependencies
How to scope a bug bounty program when most of your attack surface lives in third-party dependencies — with guidance on payouts, triage, and upstream coordination.
uuid npm: Security Review and Safe Usage Guide
The uuid npm package is one of the most-installed libraries in the JavaScript ecosystem. Here is an honest look at its security posture and how to use it correctly.
SCA Vulnerabilities: How to Find and Fix Them in Your Dependencies
SCA vulnerabilities are known security flaws in the open-source packages your app pulls in. Here is how to detect them, cut the noise, and fix the ones that matter.
Is swagger-ui-react Safe? A Security Guide for React API Docs
swagger-ui-react has no known direct CVEs, but its real risk lives in a deep dependency tree. Here is how to embed it without inheriting a transitive XSS.
https-proxy-agent: What It Does and How to Use It Safely
A practical security review of https-proxy-agent, the Node.js module that tunnels HTTPS through an HTTP proxy, plus the advisories worth knowing before you pin a version.
The Bootstrap Freelancer Theme: A Security Review Before You Ship It
The Bootstrap Freelancer theme is a popular free portfolio template, but shipping it unchanged pulls in front-end dependencies you need to check first.
chokidar on npm: A Security Review of the File-Watching Library
chokidar is the file-watching library behind most of the Node.js tooling ecosystem, and version 4 cut its dependency count from 13 to 1. Here is what that means for your supply chain risk.
Define SCA: What Software Composition Analysis Actually Means
To define SCA: it's the practice of identifying every open-source component in your software and checking each for known vulnerabilities, license risk, and staleness.
Rust Feature Flags: Supply Chain Implications
Cargo feature flags look like a compilation convenience but they are a load-bearing piece of your supply chain posture. Here is why.
Dependency Compromise Timeline Reconstruction
How to rebuild a precise timeline after a dependency has been compromised, using lockfile history, registry metadata, and CI logs.
How to Measure Dependency Freshness in CI
A practical CI tutorial for measuring dependency freshness, setting SLOs for version drift, and failing builds when packages fall too far behind upstream.
Dependency Update Triage Strategy for Eng Teams
An update PR is not a security finding. Here is a triage model that keeps reachability, risk, and engineering effort in the right conversation.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.