Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A security-focused review of the express-validator npm package: what it protects you from, what it does not, and how to configure it so bad input never reaches your handlers.
The npm pino logger is one of the fastest and best-maintained logging libraries for Node.js, and it is safe for production when you configure redaction and transports carefully.
A practical look at what installing rollup from npm means for your supply chain, the DOM clobbering XSS bug you should know about, and how to pin a safe version.
node-forge shipped signature-forgery and prototype-pollution fixes over the years, and its release cadence has gone quiet. Here is what each node-forge vulnerability meant and what to reach for today.
The zxcvbn npm package still works well for password strength estimation, but the original Dropbox library is effectively unmaintained. Here is what that means and what to use instead.
The original react-json-view package is popular but unmaintained. Here is what that means for your app's security and which fork to move to.
class-validator powers input validation in most NestJS apps, but its defaults burned teams once before. Here is its real security history and how to configure it safely.
The rn-fetch-blob npm package hasn't shipped a release since 2020. Here's what that means for React Native apps still depending on it, and how to migrate to react-native-blob-util.
swagger-ui-react has no known direct CVEs, but its real risk lives in a deep dependency tree. Here is how to embed it without inheriting a transitive XSS.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
