> For the complete documentation index, see [llms.txt](https://docs.optimumsec.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.optimumsec.xyz/coding/avoid-vendoring.md).

# Avoid Vendoring Dependencies

Vendoring smart contracts or libraries—copying them directly into your project—can lead to significant risks, including:

1. **Security Risks:** Vendored code doesn't automatically benefit from updates or security patches, leaving your project vulnerable.
2. **Auditing Challenges:** Embedded dependencies are harder to track and audit, reducing transparency.
3. **Upgradability Issues:** Vendoring locks you into outdated versions, making it difficult to adopt new features or fixes.
4. **Increased Complexity:** Managing multiple vendored libraries adds unnecessary project overhead.

***

## Best Practice: Use Package Managers

Leverage tools like **npm**, **yarn**, **Forge**, or **Hardhat** to manage dependencies efficiently. These tools ensure easy updates, version control, and compatibility, keeping your code secure and maintainable.