open-source-security
Safeguard articles tagged "open-source-security" — guides, analysis, and best practices for software supply chain and application security.
371 articles
broadcast-channel npm Package: Health, Security, and Alternatives
A practitioner review of the broadcast-channel npm package: maintenance health, how its storage fallbacks work, the security boundaries of cross-tab messaging, and when the native API is enough.
Apache v2: What the Apache License 2.0 Actually Requires
A plain-English guide to Apache v2 — what the Apache License 2.0 permits, the obligations it puts on you, its patent grant, and how it affects your open-source compliance.
When to Fork an Abandoned Dependency
Forking looks like a one-time action but is really a multi-year maintenance commitment. Here is a decision framework for when a fork beats patching, vendoring, or replacing.
What a WhiteSource Scan Actually Checks (and How Mend Changed It)
A WhiteSource scan is a software composition analysis run that inventories your open source dependencies and flags known vulnerabilities and license risks. Here is what it looks at and how the Mend rebrand affects your pipeline.
node-fetch: Vulnerability History and the Native fetch Upgrade Path
The npm node-fetch package served a decade of HTTP requests and picked up two notable CVEs along the way. Here is its vulnerability history and how to move to native fetch.
core-js on npm: Security Review and Safe Usage
A security and sustainability review of core-js on npm: the postinstall history, the maintainer funding crisis, and how to keep this near-universal dependency safe.
npm uninstall package: How to Safely Remove Dependencies
How the npm uninstall package command works, what it leaves behind, and how to confirm a removed dependency is actually gone from your tree and your risk surface.
Define SCA: What Software Composition Analysis Actually Means
To define SCA: it's the practice of identifying every open-source component in your software and checking each for known vulnerabilities, license risk, and staleness.
The Software Composition Analysis Market in 2024: Consolidation and Evolution
The SCA market is maturing fast, with acquisitions, AI-powered analysis, and SBOM mandates reshaping the competitive landscape and what buyers should expect.
OpenSSF Launches SIREN: A Mailing List for Open Source Threat Intelligence
The Open Source Security Foundation introduces SIREN, a dedicated mailing list for sharing real-time threat intelligence about attacks targeting open source ecosystems.
The MIT License, Meaning in Plain English
The MIT license meaning, stripped of legalese: do almost anything you want with the code, keep the copyright notice, and the author owes you nothing if it breaks.
SCA in Cyber Security: What It Actually Means
SCA in cyber security stands for software composition analysis — the practice of identifying every open-source component in an application and checking it against known vulnerabilities and licenses.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.