Security
URLEncoder in Java: Correct Usage and Its Security Pitfalls
URLEncoder in Java is easy to misuse. Here is when it applies, why it is not URL encoding for whole URLs, and the injection risks of getting it wrong.
May 17, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity
What Is an Application Security Model, and How Do You Build One?
An application security model is the structured way you define, measure, and improve how your applications resist attack, usually expressed through a maturity model.
May 17, 20266 min read
Open Source
react-scripts After Create React App: A Security Guide
With Create React App deprecated, react-scripts is now in maintenance mode. Here is what that means for the security of projects still depending on it.
May 17, 20265 min read
Open Source
prop-types npm: Security Review and Safe Usage
The prop-types npm package is a runtime type checker React split out years ago. React 19 stopped honoring propTypes internally, which changes when and why you should still depend on it.
May 17, 20266 min read
Industry Analysis
Exploring vulnerabilities in GitHub Actions workflows
From the tj-actions/changed-files hijack to PyTorch's self-hosted runner breach, real incidents show how GitHub Actions workflows keep getting exploited.
May 17, 20266 min read
Software Supply Chain Security
Malicious Package Detection: Behavioral vs Signature-Base...
A side-by-side look at signature-based malicious package detection (like Endor Labs) versus behavioral analysis, using real npm attack timelines from Shai-Hulud to chalk/debug.
May 17, 20267 min read
Open Source
How Do You Create an npm Module Securely?
To create an npm module you need package.json, a clear entry point, and a publish step, but doing it safely means locking down metadata, tokens, and what actually ships. Here is the full walkthrough.
May 17, 20265 min read
Open Source
Is react-native-gesture-handler Safe? An npm Security Review
react-native-gesture-handler is a core, actively maintained library, but any native module changes your app's trust and update calculus. Here is the security review.
May 17, 20264 min read
DevSecOps
Securing self-hosted GitHub Actions runners
Self-hosted GitHub Actions runners trade GitHub's ephemeral isolation for persistent infrastructure access — here's how real incidents like CVE-2025-30066 exploited that gap.
May 17, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.