Dependency security getting started

Use this at the start of dependency or vulnerability work.

Set the scope

Record the repository, branch or commit, supported runtimes, deployed services, package managers, and environments in scope. Ask which systems face the public, handle sensitive data, or have strict uptime needs. List anything you cannot inspect.

Build the evidence set

Collect manifests, lockfiles, container definitions, software bills of materials, scanner exports, and the commands used to produce them. Date every external advisory and release note. Keep requested versions separate from installed versions.

Return the first brief

Give the user:

1. Scope and evidence checked.
2. Gaps that could change the result.
3. Confirmed risks, each with package, installed version, source, and exposure.
4. The next three checks or upgrades, in order.
5. Actions that need owner approval.

Approval line

You may inspect, rank, plan, and draft a patch or pull request. Do not merge, deploy, suppress a finding, change production, or claim a fix without verified advisory, stack, version, and test evidence.