Three myths about dependency vulnerabilities

Every audit we run turns up some version of this. A few things about dependency vulnerabilities that get repeated more often than they get checked.

The realistic threat for most small businesses is automated and opportunistic, not targeted. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

“It only matters for big sites”

Your code is a small part of what you ship. That sounds obvious written down. It is still the thing most often skipped. The version that survives contact with a real deadline is the simple one.

“We can deal with it after launch”

Sometimes true, usually expensive. That sounds obvious written down. It is still the thing most often skipped.

“Our platform handles it”

Fewer dependencies is a security strategy. This is the sort of thing that compounds, quietly, in both directions. It is the sort of thing that looks like polish right up until it costs you an enquiry.

In practice

Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about dependency vulnerabilities before you move on:

• Someone can say what the current setup is without going to look
• Your code is a small part of what you ship — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If you are not sure where your systems currently stand on this, it takes us about an hour to find out.