That’s a great question! One of the reasons Medplum tries to keep it’s dependency footprint as small as possible is to reduce the possibility of introducing vulnerabilities through 3rd-party packages, and we try to default to large, battle tested dependencies. We also use automated tools like Dependabot to automatically scan our repositories for dependency upgrades.

Lastly as part of our SOC2 compliance we have systems in place where anyone can notify us of a security issue by emailing [email protected]