software supply-chain security
Software supply-chain security addresses risks in dependencies, build inputs, and distribution.
Use this when A patch adds a package, build plugin, or downloaded executable.
without the term
“The agent added a package I've never heard of to fix this. How do I know it's legit and not malware or a typo-squatted name? Do we even need it?”
with the term · How do you ask a model for software supply-chain security?
Review this new dependency’s identity, install scripts, and required privileges. Verify the lockfile and document why the existing dependencies are insufficient.
What is software supply-chain security?
Every dependency, build plugin, and downloaded binary runs with your code's privileges. Check that the package is the one you meant, review its install scripts, and keep the lockfile.
Why does software supply-chain security matter when vibe coding?
A plausible package name or install script can introduce unintended code execution.
How do you do software supply-chain security?
Verify the package identity, review installation behavior, and preserve reproducible dependency resolution.
What goes wrong with software supply-chain security?
Assuming a pinned version is necessarily safe because it is reproducible.