Governance of Third-Party Libraries and Components
🌟 Objective
Establish clear and verifiable rules for the use, approval, replacement and traceability of third-party libraries and components in internally developed applications.
🚨 Many supply chain incidents originate in malicious, abandoned or unverified libraries. This control is fundamental.
🔢 Governance principles
- Permitted repositories must be explicitly defined and controlled.
- Every library must have:
- Active maintenance
- A compatible licence
- Validated minimum popularity/community
- Libraries with active CVEs may not be used without a formalised exception.
- The use of "exotic" or single-author libraries must be justified.
🚀 Approval process
| Stage | Action | Artefact |
|---|---|---|
| Request for a new lib | Dev submits name, version, function, origin | Form / issue |
| Security analysis | AppSec or reviewer checks: CVEs, origin, history | Comment with approval or veto |
| Legal validation | (optional) Checks licence compatibility | List of approved licences |
| Formal approval | Record of the decision and validity period (if applicable) | Approvals repository |
This process may be lightweight (via Pull Request) or formalised (via a registration tool).
🔎 Acceptance criteria
| Criterion | Recommended? | Justification |
|---|---|---|
| Permissive open source licence | Yes | E.g. MIT, Apache 2.0 |
| Actively maintained (>1 year) | Yes | Recent commits and updated versions |
| Active community (issues/PRs) | Yes | Avoids abandoned libraries |
| Use in other projects | Yes | Reinforces trust and stability |
| Presence of tests or CI | Yes | Indicates the project's maturity |
| Obfuscated or minified code | No | Avoid opaque dependencies |
| Unknown or suspicious origin | No | Exclude unverified sources |
📝 Decision record
Each library must be traceable to an approval decision. Recording the following is suggested:
- Name, version, package hash
- Justification for use
- Result of the SCA analysis
- Approval or exception
- Owner and date
This record may live in a
.yamlfile, a Git repository, Confluence, Jira, etc.
📎 Cross-references
| Document | Relationship with governance |
|---|---|
01-inventario-sbom.md | Control of what is being used |
02-analise-sca.md | Basis for acceptance or blocking |
09-excecoes-e-aceitacao-risco.md | Formal justifications for deviations |
🔍 Dependency governance is one of the pillars of modern security, especially in exposed environments or those with regulatory obligations (NIS2, CRA, ISO 27001).