open-source
Safeguard articles tagged "open-source" — guides, analysis, and best practices for software supply chain and application security.
167 articles
How to Make an npm Package: A Step-by-Step Guide
Learning how to make an npm package takes about ten minutes of setup and a lifetime of not shipping your .env file. This guide covers the full path from init to publish, safely.
Software License Examples and Why They Matter for Security
A software license example is more than boilerplate — it defines your obligations and your risk. Here is how to read common licenses and enforce them at scale.
react-native-modal-datetime-picker: Security and Maintenance Guide
The react-native-modal-datetime-picker package is popular and convenient, but its maintenance status and transitive dependencies deserve a look before you commit to it.
react-native-webview Security: Hardening WebViews in Mobile Apps
The react-native-webview component gives your app a browser inside the app, and that power is exactly why it needs careful configuration to avoid opening a hole in your mobile security.
Is the npm he Package Safe to Use? A Security Review
The npm he package is a tiny, dependency-free HTML entity encoder and decoder. Here is what it does, whether it is safe, and where developers misuse it.
Copyleft vs Copyright: What the Difference Means for Your Dependencies
A practical breakdown of copyleft vs copyright, how copyleft licenses like the GPL actually work, and why the distinction shows up in your software bill of materials.
npm install --legacy-peer-deps: What It Does and When It Bites
npm install --legacy-peer-deps tells npm to skip peer dependency resolution entirely, the way npm 4-6 did. That unblocks a broken install today and quietly plants runtime and security problems for later.
date-fns-tz: Time Zone Handling and Package Health Review
A practical review of the npm date-fns-tz package: how it handles IANA time zones, how healthy the project is, and when date-fns v4's built-in time zone support replaces it.
Snyk Advisor: What It Is and How to Read Its Score
Snyk Advisor is a free package health tool that rates open source packages from 0 to 100 across popularity, maintenance, security, and community. Here is how to use it well.
react-diff-view: Using the Diff Component Securely
react-diff-view renders git unified diffs in React apps. Here is how it works, where the security considerations sit, and how to keep it safe when you render untrusted diffs.
Licence logicielle : le guide securite et conformite
Ce qu'est une licence logicielle, pourquoi elle constitue un risque de securite et de conformite dans vos dependances open source, et comment la gerer concretement.
usehooks-ts: A Typed React Hooks Library Reviewed
usehooks-ts packs 30+ typed React hooks into a tree-shakable package with a single dependency. Here is what it does well, where it is aging, and how to vet it before adoption.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.