Good question. We take this seriously, and try to keep the dependency footprint small (which is a challenge in the node/npm ecosystem). We try to stick with large, battle-tested dependencies (express, react, etc). For less popular projects, we will clone and run and perform our own internal audit.

We also follow best practices with automated tools like Sonar and Dependabot to automatically scan dependencies. We've gone through multiple pen tests. There's no silver bullet though, so it's a constant battle.

That’s a great question! One of the reasons Medplum tries to keep it’s dependency footprint as small as possible is to reduce the possibility of introducing vulnerabilities through 3rd-party packages, and we try to default to large, battle tested dependencies. We also use automated tools like Dependabot to automatically scan our repositories for dependency upgrades.

Lastly as part of our SOC2 compliance we have systems in place where anyone can notify us of a security issue by emailing [email protected]