Getting started with dependency vulnerabilities
Every audit we run turns up some version of this. A short on-ramp to dependency vulnerabilities for teams who have not touched it before.
The cheapest security work is the boring kind done on a schedule. It is the sort of thing that looks like polish right up until it costs you an enquiry.
Why it matters
Your code is a small part of what you ship. None of that requires a large budget, only a decision and someone to own it. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.
Your first week
- Find out what is already in place
- Automated alerts catch what manual review never will
- Change one thing and measure it
Fewer dependencies is a security strategy. The reasoning matters more than the rule, because the rule has exceptions. Doing this properly once is usually cheaper than doing it approximately three times.
The short version
Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about dependency vulnerabilities before you move on:
- Someone can say what the current setup is without going to look
- Automated alerts catch what manual review never will — and you know whether that is true here
- There is a way to tell whether the last change to this helped
If you are not sure where your systems currently stand on this, it takes us about an hour to find out.