diff --git a/.snyk b/.snyk
new file mode 100644
index 00000000000..ace70723fb4
--- /dev/null
+++ b/.snyk
@@ -0,0 +1,8 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.13.5
+ignore: {}
+# patches apply the minimum changes required to fix a vulnerability
+patch:
+  'npm:moment:20170905':
+    - '@spinnaker/kayenta > moment-timezone > moment':
+        patched: '2019-10-17T18:18:57.644Z'
diff --git a/package.json b/package.json
index d7f5ce672e9..177ee978de7 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,9 @@
     "int": "protractor protractor.conf.js",
     "modules": "./gradle/buildModules.sh",
     "prettier": "prettier --write 'app/**/*.{js,jsx,ts,tsx,html,css,less}'",
-    "functional": "test/functional/run.js --serve-deck --replay-fixtures --browser chrome --headless"
+    "functional": "test/functional/run.js --serve-deck --replay-fixtures --browser chrome --headless",
+    "snyk-protect": "snyk protect",
+    "prepublish": "npm run snyk-protect"
   },
   "dependencies": {
     "@fortawesome/fontawesome-free": "^5.4.1",
@@ -57,14 +59,14 @@
     "d3-shape": "^1.2.0",
     "date-fns": "^1.30.1",
     "diff-match-patch": "^1.0.0",
-    "dompurify": "^1.0.4",
+    "dompurify": "^2.0.3",
     "formik": "^1.4.1",
     "human-readable-ids": "^1.0.4",
     "jquery": "3.4.0",
     "jquery-textcomplete": "1.6.1",
     "jquery-ui": "1.12.0",
     "js-worker-search": "^1.2.1",
-    "js-yaml": "^3.9.0",
+    "js-yaml": "^3.13.1",
     "lodash": "^4.17.13",
     "lodash-decorators": "4.5.0",
     "luxon": "^1.11.3",
@@ -97,7 +99,8 @@
     "source-map": "^0.4.4",
     "source-sans-pro": "^2.0.10",
     "spel2js": "^0.2.1",
-    "ui-select": "^0.19.6"
+    "ui-select": "^0.19.6",
+    "snyk": "^1.235.1"
   },
   "devDependencies": {
     "@types/angular": "1.6.26",
@@ -222,5 +225,6 @@
     "hooks": {
       "pre-commit": "pretty-quick --staged"
     }
-  }
+  },
+  "snyk": true
 }