angular
Safeguard articles tagged "angular" — guides, analysis, and best practices for software supply chain and application security.
14 articles
XSS defaults and escape hatches: React, Vue, and Angular compared
All three major frameworks escape output by default, but each ships a named escape hatch that turns raw HTML back on — and only one sanitizes it automatically.
@angular-devkit/build-angular: A Security Guide to the Angular Build Package
@angular-devkit/build-angular is the build toolchain behind the Angular CLI. Most of its security risk is transitive, coming from the build and dev-server dependencies it pulls in.
angular.io Security: Keeping Your Angular App Safe in 2025
The docs at angular.io teach safe defaults, but recent CVEs in SSR, the HTTP client, and template sanitization show where the framework still needs your attention.
ngx-cookie-service: Secure Cookie Handling in Angular
ngx-cookie-service makes reading and writing cookies in Angular trivial, but the security depends entirely on the flags you set. Here is how to use it without leaking session data.
@angular-builders/custom-webpack: Extending Angular Builds Without Ejecting
The @angular-builders/custom-webpack package lets you merge custom webpack config into Angular CLI builds. Here is how it works and how to use it without adding risk.
Angular CDK: What Ships in @angular/cdk and Keeping It Current
The angular cdk npm package is the behavior layer under Angular Material — overlays, a11y, drag-drop, virtual scroll. Knowing what is inside and how its versioning works keeps upgrades boring.
tinymce-angular Security: What to Know Before You Ship
The tinymce-angular wrapper is thin, but it ships a full rich-text editor whose sanitization gaps have produced real XSS CVEs. Here is how to use it safely.
Interpolation in Angular: How It Works and Where the XSS Risks Hide
Interpolation in Angular binds component data into templates and is safe by default because Angular escapes it. The danger starts when you reach for bypasses.
ng-bootstrap: Using and Securing Angular's Bootstrap Widgets
ng-bootstrap gives Angular apps native Bootstrap widgets with no jQuery dependency. Here is how to keep it current and where the real security work actually lives.
angular-auth-oidc-client: A Security-Focused Guide to Angular OIDC
angular-auth-oidc-client is a certified Angular library for OpenID Connect and OAuth2. Here is how to use it and how to configure it securely.
@angular-eslint/builder: What It Is and How to Use It Safely
The @angular-eslint/builder package wires ESLint into the Angular CLI so you can run ng lint. Here's how it fits your build and where the supply-chain risk actually lives.
@angular-builders/jest: Setup and Dependency Security
@angular-builders/jest lets you run ng test with Jest instead of Karma. Here is how it works, the version-alignment rule that trips teams up, and how to keep its dependency tree secure.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.