open-source
Safeguard articles tagged "open-source" — guides, analysis, and best practices for software supply chain and application security.
167 articles
Open Source Maintainer Succession Planning: A Supply Chain Imperative
When a solo maintainer disappears, entire dependency chains are at risk. How organizations should approach succession planning for critical open source projects.
CVE-2025-49794 in libxml2: Patch Posture & SBOM Response
libxml2 use-after-free during XPath schematron parsing scored CVSS 9.1. Defender SBOM playbook for one of the most-embedded libraries on the planet.
react-helmet-async: Is It Safe to Depend On in 2025?
react-helmet-async manages document head tags in React apps, but its maintenance history is bumpy. Here is what the package does, where the risk sits, and how to depend on it safely.
How Do You Create an npm Module Securely?
To create an npm module you need package.json, a clear entry point, and a publish step, but doing it safely means locking down metadata, tokens, and what actually ships. Here is the full walkthrough.
react-grid-layout: Package Health and Production Considerations
A production-focused review of the react-grid-layout npm package: what it does well, its maintenance profile, performance traps, and how to depend on it responsibly.
Building an Open Source Risk Intelligence Platform: Beyond Vulnerability Scanning
Vulnerability scanning is one dimension of open source risk. A true risk intelligence platform must also evaluate maintainer health, project sustainability, licensing, and malicious package threats.
com.google.code.gson: Using Gson Safely in Modern Java
Why the com.google.code.gson group ID looks so odd, what maintenance mode means for the library, and the configuration habits that keep Gson safe in modern Java services.
Linux Foundation versus Apache Software Foundation: how governance shapes supply-chain risk
Both foundations host critical software, but they organize it very differently. The Linux Foundation's project-by-project incubation model and the ASF's uniform graduation process produce different risk profiles for the consumers downstream.
A practical framework for assessing single-maintainer project risk
Truck factor is the headline metric, but it is not enough. Here is a working framework for evaluating single-maintainer projects in your dependency tree without panicking or being naive.
Maintainer burnout is a supply-chain risk: lessons from xz-utils
The xz-utils backdoor was made possible because a single exhausted maintainer accepted help from a patient and well-resourced stranger. Sustaining critical maintainers is now a security problem, not just a moral one.
Socket.dev vs Phylum: which supply chain risk scanner fits your stack in 2026
How Socket.dev and Phylum compare on behavioral detection, ecosystem coverage, scoring transparency, and the developer ergonomics that decide adoption.
SCA Full Form in Engineering: What Software Composition Analysis Means
In software engineering and security, the SCA full form is Software Composition Analysis: the practice of inventorying and vetting the open-source components your code depends on.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.