open-source-security
Safeguard articles tagged "open-source-security" — guides, analysis, and best practices for software supply chain and application security.
371 articles
Securing mobile app dependencies: CocoaPods and Gradle
CocoaPods and Gradle power millions of mobile apps. See how orphaned pods, build-script RCE, and dependency confusion put them at real risk today.
Permissive License Explained: MIT, Apache 2.0, and BSD Risks
What a permissive license is, how MIT, BSD, and Apache 2.0 differ, and the compliance and security risks teams overlook when they assume permissive means risk-free.
angular-ui-router: Security and Maintenance Guide
angular-ui-router is the classic routing library for AngularJS 1.x. The library itself is stable, but the framework it depends on reached end of life, and that is the real risk to weigh.
Best Open Source SCA Tools in 2026 (Tested on a Real Monorepo)
OSV-Scanner, Trivy, Grype, Dependency-Check, and dep-scan, all run against the same 4,300-dependency monorepo. Recall, false positives, and scan times measured.
The State of Open Source Security report (annual series)
Safeguard's annual State of Open Source Security Report finds transitive dependencies now drive most exposure, and reachability — not CVSS alone — separates mature security programs.
Software supply chain attacks: how they work and recent e...
Software supply chain attacks like SolarWinds, xz-utils, and polyfill.io bypass vulnerability scanners entirely. Here's how they work and where provenance verification fills the gap.
NPM package vulnerabilities: risks and detection
NPM's open, high-velocity ecosystem makes it a top target for supply chain attacks. Here's how vulnerabilities slip past scanners like Trivy undetected.
5 risks of open source software in 2026
Open source now makes up most enterprise code. Here are 5 risks defining open source software security in 2026 — and how to close the exploitability gap.
162 vulnerabilities disclosed in Java's top 10 libraries
Safeguard's H1 2026 analysis found 162 CVEs across Java's ten most-downloaded libraries, with critical RCE risk concentrated in Tomcat and Spring.
react-native-walkthrough-tooltip: Security and Maintenance
react-native-walkthrough-tooltip is popular but inactively maintained. Here is how to assess its risk, decide whether to keep it, and manage aging RN dependencies.
Open source package health scoring explained
Health scores from OSSF Scorecard, Snyk, and npms.io compress package risk into one number -- but xz-utils proves a high score isn't the same as safe.
What to check before installing an open source package
A practical guide to vetting open source packages before you install them — real incidents, concrete checks, and how reachability analysis cuts through CVE noise.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.