What problem does it solve?
Dependency management often becomes a source of security and maintenance risk when new packages are added or upgraded without proper vetting and licensing checks.
Core Features & Use Cases
- Pre-Approved Libraries: A vetted list per language that can be installed without extra approvals, plus policy guidance for new dependencies.
- Vetting & Compliance: Security checks, license compatibility, and maintenance indicators to evaluate risk.
- Best Practices: Pin exact versions, commit lockfiles, and use audit tools across ecosystems.
Use cases:
- When adding a new package to a JS/Python/Go project, ensure it’s on the approved list and passes security and licensing checks.
- When upgrading dependencies, enforce version pinning and lockfile hygiene.
- When performing a security/license review, run standard audits and document decisions.
Quick Start
To begin, audit current dependencies with your language's standard tools, pin exact versions, and commit updated lockfiles. Then enforce the approval process for non-pre-approved packages and maintain license compliance.
