Is supply chain security harder than it needs to be?
Many developers just want to ship their features. “Ok, that’s fine, but do it safely,” we say. But what does safely mean? Do the developers know what to do? If they know what to do, do they know how to do it? If they know how to do it, do they have the time to do it? What if they know how to do it, but their coding agent doesn’t? What are we asking, is it all that much? It’s just: scan for vulns, run linters, ship an SBOM, have tests, update your dependencies frequently - but not too frequently, use SLSA, verify the package, did you remember to check that your build caching strategy is safe? Are you using trusted publishing? Did you remember to turn off the manual flows? Did you remember to remove pull_request_target? That’s not a complete list. Even if it were a complete list today , it wouldn’t be the same list tomorrow . The attackers are always finding another way in, and the people working in supply chain security are doing amazing ...