diff --git a/dot_npmrc b/dot_npmrc
new file mode 100644
index 0000000..500cf27
--- /dev/null
+++ b/dot_npmrc
@@ -0,0 +1,28 @@
+
+## Ignore all lifecycle scripts by default. You can
+## still allow them on a per-package basis with
+## @lavamoat/allow-scripts
+ignore-scripts=true
+# Avoid installing packages published in last 2 days
+min-release-age=3
+## Don't install packages from git urls, which can
+## be used to bypass the above two settings
+allow-git=none
+## allow direct git dependencies only
+# allow-git=root
+
+## Enable this if you never want to use git dependencies
+## Break git usage for older npm versions that don't
+## support allow-git and repositories that override it
+# git=false
+
+## Don't install packages without asking (only
+## applicable to old npx versions)
+install=false
+
+## enable this if you don't really use npm and want to
+## avoid consequences of some script calling npm or npx
+## Don't install packages unless they're in local cache
+# offline=true
+## Don't put commands from packages in PATH
+# bin-links=false