diff --git a/packages/react-scripts/.snyk b/packages/react-scripts/.snyk
new file mode 100644
index 00000000000..f398170c84c
--- /dev/null
+++ b/packages/react-scripts/.snyk
@@ -0,0 +1,22 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.13.1
+ignore: {}
+# patches apply the minimum changes required to fix a vulnerability
+patch:
+  'npm:hoek:20180212':
+    - webpack-dev-server > chokidar > fsevents > node-pre-gyp > hawk > hoek:
+        patched: '2018-12-08T07:47:09.191Z'
+    - webpack > watchpack > chokidar > fsevents > node-pre-gyp > hawk > hoek:
+        patched: '2018-12-08T07:47:09.191Z'
+    - webpack-dev-server > chokidar > fsevents > node-pre-gyp > hawk > sntp > hoek:
+        patched: '2018-12-08T07:47:09.191Z'
+    - webpack-dev-server > chokidar > fsevents > node-pre-gyp > hawk > boom > hoek:
+        patched: '2018-12-08T07:47:09.191Z'
+    - webpack-dev-server > chokidar > fsevents > node-pre-gyp > hawk > cryptiles > boom > hoek:
+        patched: '2018-12-08T07:47:09.191Z'
+    - webpack > watchpack > chokidar > fsevents > node-pre-gyp > hawk > sntp > hoek:
+        patched: '2018-12-08T07:47:09.191Z'
+    - webpack > watchpack > chokidar > fsevents > node-pre-gyp > hawk > boom > hoek:
+        patched: '2018-12-08T07:47:09.191Z'
+    - webpack > watchpack > chokidar > fsevents > node-pre-gyp > hawk > cryptiles > boom > hoek:
+        patched: '2018-12-08T07:47:09.191Z'
diff --git a/packages/react-scripts/package.json b/packages/react-scripts/package.json
index 1b8fafff983..66c40c1ec26 100644
--- a/packages/react-scripts/package.json
+++ b/packages/react-scripts/package.json
@@ -50,7 +50,7 @@
     "html-webpack-plugin": "2.29.0",
     "husky": "^0.14.3",
     "jest": "23.0.0",
-    "lint-staged": "^4.2.3",
+    "lint-staged": "^4.3.0",
     "minimist": "^1.2.0",
     "object-assign": "4.1.1",
     "postcss-flexbugs-fixes": "3.2.0",
@@ -65,7 +65,8 @@
     "webpack": "3.8.1",
     "webpack-dev-server": "2.9.4",
     "webpack-manifest-plugin": "1.3.2",
-    "whatwg-fetch": "2.0.3"
+    "whatwg-fetch": "2.0.3",
+    "snyk": "^1.116.2"
   },
   "devDependencies": {
     "react": "^16.0.0",
@@ -73,5 +74,10 @@
   },
   "optionalDependencies": {
     "fsevents": "^1.1.3"
-  }
+  },
+  "scripts": {
+    "snyk-protect": "snyk protect",
+    "prepublish": "npm run snyk-protect"
+  },
+  "snyk": true
 }