3 ms·
Congrats! What kind of dependency vetting and monitoring is required for something like this where compliance is part of the picture?
by jjnoakes 4y ago
Congrats!
What kind of dependency vetting and monitoring is required for something like this where compliance is part of the picture?
- brown 4y agoGood question. We take this seriously, and try to keep the dependency footprint small (which is a challenge in the node/npm ecosystem). We try to stick with large, battle-tested dependencies (express, react, etc). For less popular projects, we will clone and run and perform our own internal audit. We also follow best practices with automated tools like Sonar and Dependabot to automatically scan dependencies. We've gone through multiple pen tests. There's no silver bullet though, so it's a constant battle.
- deleted 4y ago[deleted]