Audit dependencies before adding them. Prefer well-maintained, widely-used packages with active maintenance. Pin versions and commit lock files. Use language-specific audit tools in CI:
- Rust:
cargo audit,cargo deny(license + advisory policies) - Python:
pip-audit,bandit(SAST) - JavaScript/TypeScript:
npm audit,pnpm audit - Go:
govulncheck - Ruby:
bundler-audit - PHP:
composer audit - Java: OWASP
dependency-checkMaven/Gradle plugin - C#:
dotnet list package --vulnerable - Elixir:
mix_auditZero tolerance for critical/high CVEs. Automate dependency update PRs where possible.