nodejs-security
Safeguard articles tagged "nodejs-security" — guides, analysis, and best practices for software supply chain and application security.
44 articles
JavaScript Exploits Explained: How They Work and How to Stop Them
JavaScript exploits target the code that runs in browsers and on Node servers. Here is how the main attack classes work and the defenses that actually hold up.
Is Node.js Safe? A Security Guide
Node.js itself is safe when kept current and configured well. Most real risk lives in your dependencies and your code, not the runtime.
Node.js vm Module Security: Why It Is Not a Sandbox
The Node.js vm module runs code in a separate V8 context, but it is not a security sandbox. Here is why untrusted code can escape it and what to use instead.
Vitest on npm: A Security Review Before You Add It
Vitest is a fast Vite-native test runner, but its API and browser-mode servers have a real security footprint. Here is what to check before adding vitest from npm.
yup npm: A Security Review of the Schema Validation Library
The yup npm package is a mature, actively maintained schema validation library, and it is safe to use, but validation belongs on the server and yup schemas need to be written defensively. Here is the review.
How to Use bcryptjs from npm Safely: A Security Review
The bcryptjs npm package is a pure-JavaScript bcrypt implementation with zero native dependencies. Here is when to reach for it, how to use it correctly, and the pitfalls that weaken password hashing.
Is the npm express Package Safe? A Security Review
The npm express package is the most widely used Node.js web framework, and it is safe to run today if you stay on a maintained version and watch its small dependencies. Here is the security picture.
Buffer Streams: Handling Binary Data Safely in Node.js
Buffer streams are how Node.js moves binary data without loading it all into memory. Here is how they work and the security bugs that hide in buffer handling.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.