diff --git a/packages/@opticss/demo-app/.snyk b/packages/@opticss/demo-app/.snyk
new file mode 100644
index 00000000..bbdd0289
--- /dev/null
+++ b/packages/@opticss/demo-app/.snyk
@@ -0,0 +1,68 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.14.1
+ignore: {}
+# patches apply the minimum changes required to fix a vulnerability
+patch:
+  SNYK-JS-LODASH-567746:
+    - babel-cli > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-generator > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-traverse > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-template > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-register > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-generator > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-traverse > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-template > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-generator > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-template > babel-traverse > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-traverse > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-helpers > babel-template > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-template > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-generator > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-template > babel-traverse > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-traverse > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-helpers > babel-template > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-template > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-helpers > babel-template > babel-traverse > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-template > babel-traverse > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-helpers > babel-template > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-core > babel-helpers > babel-template > babel-traverse > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-template > babel-traverse > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-helpers > babel-template > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-helpers > babel-template > babel-traverse > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
+    - babel-cli > babel-register > babel-core > babel-helpers > babel-template > babel-traverse > babel-types > lodash:
+        patched: '2020-04-30T21:52:37.765Z'
diff --git a/packages/@opticss/demo-app/package.json b/packages/@opticss/demo-app/package.json
index a1144700..e59e7e7e 100644
--- a/packages/@opticss/demo-app/package.json
+++ b/packages/@opticss/demo-app/package.json
@@ -19,7 +19,9 @@
     "remap": "remap-istanbul -i build/coverage/coverage.json -o coverage -t html",
     "docs": "typedoc --out ./docs .",
     "start": "node server.js",
-    "watch": "watch 'yarn run compile' './src' './static' './test' --wait=1"
+    "watch": "watch 'yarn run compile' './src' './static' './test' --wait=1",
+    "snyk-protect": "snyk protect",
+    "prepublish": "npm run snyk-protect"
   },
   "bin": "bin/opticss",
   "repository": {
@@ -46,7 +48,8 @@
     "opticss": "^0.7.0",
     "parse5": "^5.0.0",
     "prettier": "1.17.1",
-    "split.js": "^1.3.5"
+    "split.js": "^1.3.5",
+    "snyk": "^1.316.1"
   },
   "devDependencies": {
     "@opticss/code-style": "^0.6.0",
@@ -67,5 +70,6 @@
     "tslint": "^5.10.0",
     "typescript": "~3.4.4",
     "watch": "^1.0.2"
-  }
+  },
+  "snyk": true
 }