# Third Party Dependencies Standards · SEC-04

This document contains standards for consuming third-party libraries and other external dependencies.

## Standard Metadata

- Area: Security
- Owner: Security group
- Last reviewed: 2026-09-09
- Next review due from: 2026-12-01
- Enforcement: Code review
- Status: Active

## Due diligence must be performed before introducing a new third-party dependency · SEC-04.1 · **MUST** · **DEV/TEST**

The due diligence must, at a minimum, cover the following questions (with an aim to answer "Yes" to every question):
1. Is the dependency stable, popular, etc. (using metrics like GitHub stars and downloads)?
1. Is the dependency actively maintained (using metrics like number of contributors and last update)?
1. Is the latest version secure (i.e. no unpatched vulnerabilities)?
1. Is the dependency solving a well-scoped, common problem (e.g. Excel integration or date parsing)?
1. Does the cost to build outweigh the risk of importing?
1. Is the dependency solving a non-trivial problem or one that likely to evolve in future (i.e. it would be harder to write our own code)?
1. Is the license acceptable for our intended use (e.g. copyleft licenses are generally to be avoided)?

## Third-party dependencies must be monitored for security vulnerabilities · SEC-04.2 · **MUST** · **DEV/TEST**

Audacia's standard approach is to generate and store SBOMs using OWASP Dependency Track.