frontend-security
Safeguard articles tagged "frontend-security" — guides, analysis, and best practices for software supply chain and application security.
36 articles
What Is the Bootstrap Latest Version, and Is It Secure?
The Bootstrap latest version is 5.3.8, and knowing your version is a security decision: older Bootstrap releases carry known XSS bugs and rely on end-of-life jQuery.
React Security Best Practices: A Practical Checklist for 2026
React escapes JSX text for you, but XSS sinks, secrets in the client bundle, token storage, and a 500-package npm worm are still yours to handle.
browser-image-compression: Is Client-Side Image Compression Safe?
browser-image-compression shrinks images in the browser before upload. Here is how it works, its security trade-offs, and why client-side compression is never validation.
ngx-bootstrap Security: What to Know After the 2025 npm Compromise
ngx-bootstrap is a popular Angular component library that was hit by a real npm supply-chain attack in September 2025. Here is what happened, what to check, and how to use it safely.
Angular Compiler Security: What @angular/compiler-cli Handles and How to Keep It Safe
The Angular compiler is more than a build step — it enforces your template sanitization contract, and a 2025 XSS bug proved that assumption can break.
localStorage Security: Why You Shouldn't Keep Tokens There
localStorage security comes down to one fact: any script on your page can read it. That makes it the wrong place for auth tokens and anything sensitive.
CVE-2022-31160: Understanding the jQuery UI Checkboxradio XSS
CVE-2022-31160 is a cross-site scripting flaw in jQuery UI's checkboxradio widget, fixed in 1.13.2. Here is how it works and how to remediate it.
Webpack 5 Node Polyfills: node-polyfill-webpack-plugin Explained
node-polyfill-webpack-plugin restores the Node core shims webpack 5 removed. Before you install it, understand what you are re-adding to your bundle and why webpack removed it.
Antd Injection: Preventing XSS in Ant Design Applications
Antd injection risk is not a flaw in the component library itself but in how you feed it untrusted data. Here is where the danger lives and how to close it.
Using the aws-amplify npm Package Safely: A Security Review
The aws-amplify npm package is a large, capable SDK that touches auth, storage, and API calls. Here is a practical security review of what to watch for and how to use it without widening your attack surface.
qrcode.react Security: Safe QR Code Rendering in React
A security guide to the qrcode.react library, the risks of encoding untrusted data into QR codes, and how to render them safely in a React app.
dom-to-image-more: Using the DOM-to-Image Fork Safely
dom-to-image-more turns a DOM node into a PNG, JPEG, or SVG in the browser. What the fork fixes, and the security considerations when rendering user content.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.