diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 775ffd71..60f4d658 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -40,6 +40,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      - run: pnpm audit:deps
       - run: pnpm typecheck
       - run: pnpm lint
 
diff --git a/.github/workflows/remote-boss-platforms.yml b/.github/workflows/remote-boss-platforms.yml
index b5966c57..e4f7872d 100644
--- a/.github/workflows/remote-boss-platforms.yml
+++ b/.github/workflows/remote-boss-platforms.yml
@@ -40,6 +40,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      - run: pnpm audit:deps
       - name: Build Boss edition
         run: node boss-build/build-boss-edition.mjs --platform=win --version=${{ inputs.version }}
         shell: bash
diff --git a/package.json b/package.json
index 71e42de7..79d0b01e 100644
--- a/package.json
+++ b/package.json
@@ -25,6 +25,7 @@
     "release:website": "node scripts/release-website.mjs",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
+    "audit:deps": "pnpm audit && npm --prefix landing audit --omit=dev",
     "test": "node --disable-warning=ExperimentalWarning ./node_modules/vitest/vitest.mjs run",
     "typecheck": "tsc --noEmit",
     "test:unit": "node --disable-warning=ExperimentalWarning ./node_modules/vitest/vitest.mjs run --config vitest.config.ts tests/unit",
@@ -34,7 +35,7 @@
     "test:e2e": "node --no-warnings ./node_modules/@playwright/test/cli.js test -c tests/e2e/playwright.config.ts",
     "test:run": "pnpm test:unit && pnpm test:integration && pnpm test:eval && pnpm test:e2e",
     "verify": "pnpm typecheck && pnpm lint && pnpm test:unit && pnpm test:integration && pnpm test:eval && pnpm test:e2e",
-    "verify:release": "pnpm verify && pnpm build:dir",
+    "verify:release": "pnpm audit:deps && pnpm verify && pnpm build:dir",
     "postinstall": "node scripts/postinstall.mjs"
   },
   "dependencies": {
diff --git a/scripts/release-boss.mjs b/scripts/release-boss.mjs
index 90123a64..229e051b 100644
--- a/scripts/release-boss.mjs
+++ b/scripts/release-boss.mjs
@@ -181,6 +181,7 @@ async function main() {
 
   const repo = await getRepoInfo();
   await ensureRemoteBuildPrerequisites(repo);
+  await run("pnpm", ["audit:deps"]);
 
   const currentVersion = (await readPackageJson()).version;
   const nextVersion = options.version ?? currentVersion;
diff --git a/scripts/release-local-mac.mjs b/scripts/release-local-mac.mjs
index 2c8f2ec4..e1cf97af 100644
--- a/scripts/release-local-mac.mjs
+++ b/scripts/release-local-mac.mjs
@@ -138,6 +138,7 @@ async function main() {
   process.env.AGENTCOMPANY_ELECTRON_PUBLISH = "never";
 
   validatePreflight();
+  await run("pnpm", ["audit:deps"]);
 
   const currentVersion = (await readPackageJson()).version;
   const nextVersion = options.version ?? (options.bump ? bumpPatchVersion(currentVersion) : currentVersion);
diff --git a/scripts/release-local-winlinux.mjs b/scripts/release-local-winlinux.mjs
index b58252fe..0a50a960 100644
--- a/scripts/release-local-winlinux.mjs
+++ b/scripts/release-local-winlinux.mjs
@@ -140,6 +140,7 @@ async function main() {
   if (nextVersion !== pkgVersion) {
     console.log(`[release-local-winlinux] version override: ${pkgVersion} -> ${nextVersion}`);
   }
+  await run("pnpm", ["audit:deps"]);
 
   await rm(localReleaseDir, { recursive: true, force: true });
   await rm(buildReleaseDir, { recursive: true, force: true });
diff --git a/scripts/release-local.mjs b/scripts/release-local.mjs
index d66c31cb..0d231cab 100644
--- a/scripts/release-local.mjs
+++ b/scripts/release-local.mjs
@@ -51,7 +51,7 @@ function printHelp() {
 
 Options:
   --platforms=mac,win,linux   Comma-separated platform list (default: all)
-  --skip-verify               Skip pnpm verify before release builds
+  --skip-verify               Skip dependency audit and pnpm verify before release builds
   --no-upload                 Build artifacts locally without publishing
   --help                      Show this help
 
@@ -251,6 +251,7 @@ async function main() {
 
   await rm(localReleaseDir, { recursive: true, force: true });
   if (!options.skipVerify) {
+    await run("pnpm", ["audit:deps"]);
     await run("pnpm", ["verify"]);
   }
   if (options.platforms.includes("mac")) {
diff --git a/scripts/release-public-cloudflare.mjs b/scripts/release-public-cloudflare.mjs
index 23f470d0..d5674a1c 100644
--- a/scripts/release-public-cloudflare.mjs
+++ b/scripts/release-public-cloudflare.mjs
@@ -95,7 +95,7 @@ function printHelp() {
 
 Options:
   --version=x.y.z          Explicit version. Defaults to current patch + 1.
-  --skip-verify            Skip local pnpm verify before packaging.
+  --skip-verify            Skip local dependency audit and pnpm verify before packaging.
   --delete-remote-branch   Delete the GitHub snapshot branch after success.
   --keep-transport-release Keep the temporary draft GitHub release after success.
   --help                   Show this help.
@@ -280,6 +280,7 @@ async function main() {
   await resetReleaseStaging();
 
   if (!options.skipVerify) {
+    await run("pnpm", ["audit:deps"]);
     await run("pnpm", ["verify"]);
   }
 
diff --git a/scripts/release-website.mjs b/scripts/release-website.mjs
index 244f645a..198fdc29 100644
--- a/scripts/release-website.mjs
+++ b/scripts/release-website.mjs
@@ -103,6 +103,7 @@ async function main() {
   await loadEnvFile(join(rootDir, ".env.release"));
 
   await prepareR2ReleaseHost({ rootDir });
+  await runPlain("pnpm", ["audit:deps"]);
 
   const version = (await readPackageJson()).version;
   console.log(`[release-website] regenerating landing for version ${version}`);
diff --git a/scripts/resume-release-public.mjs b/scripts/resume-release-public.mjs
index 6867ceed..5f3e3d94 100644
--- a/scripts/resume-release-public.mjs
+++ b/scripts/resume-release-public.mjs
@@ -83,6 +83,7 @@ async function main() {
   await loadEnvFile(join(rootDir, ".env.release"));
 
   const repo = await getRepoInfo();
+  await run("pnpm", ["audit:deps"]);
 
   await uploadWinAndLinuxToR2();
   await run("node", ["scripts/generate-landing-release-links.mjs"]);