diff --git a/.snyk b/.snyk
new file mode 100644
index 0000000..ab1021c
--- /dev/null
+++ b/.snyk
@@ -0,0 +1,8 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.13.5
+ignore: {}
+# patches apply the minimum changes required to fix a vulnerability
+patch:
+  SNYK-JS-LODASH-450202:
+    - '@orchejs/common > @types/winston > winston > async > lodash':
+        patched: '2019-07-03T21:00:59.692Z'
diff --git a/package.json b/package.json
index c1e9688..624fe5a 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,8 @@
   },
   "dependencies": {
     "@orchejs/common": "^0.3.1",
-    "reflect-metadata": "^0.1.10"
+    "reflect-metadata": "^0.1.10",
+    "snyk": "^1.189.0"
   },
   "devDependencies": {
     "@types/body-parser": "^1.16.4",
@@ -39,7 +40,9 @@
     "tsc": "node_modules/.bin/tsc --project tsconfig.json",
     "post-compile": "node ./node_modules/shx/lib/cli.js cp -r {package.json,README.md} ./build/rest",
     "build": "npm run clean && npm run test && npm run tsc && npm run post-compile",
-    "coverage": "npm run clean && node ./node_modules/nyc/bin/nyc.js --reporter=lcov node ./node_modules/mocha/bin/mocha"
+    "coverage": "npm run clean && node ./node_modules/nyc/bin/nyc.js --reporter=lcov node ./node_modules/mocha/bin/mocha",
+    "snyk-protect": "snyk protect",
+    "prepublish": "npm run snyk-protect"
   },
   "repository": {
     "type": "git",
@@ -53,5 +56,6 @@
   "bugs": {
     "url": "https://github.com/orchejs/rest/issues"
   },
-  "homepage": "https://github.com/orchejs/rest#readme"
+  "homepage": "https://github.com/orchejs/rest#readme",
+  "snyk": true
 }