Protect · Dependency scanning
Why we use Snyk & Dependabot
Snyk and GitHub Dependabot check the open-source packages a project depends on against databases of known vulnerabilities.
Why it’s in our stack
- 01
Known flaws flagged early
Vulnerable packages are reported as soon as a security advisory is released.
- 02
Fixes proposed automatically
Update pull requests are opened so patches can be reviewed and shipped quickly.
- 03
Continuous, not one-off
Checks keep running as the code changes and new advisories appear, not only at launch.