Practical guidance for software supply chain security decisions and defensible security work.
8 resources
Dependency confusion prevention controls package namespaces, registry routing, lockfiles, provenance, and build telemetry across private and public feeds.
Container registry compromise detection links authentication, manifest and tag changes, image digests, signatures, pulls, deployments, and runtime impact.
Self-hosted CI runner compromise defense covers trust boundaries, job provenance, persistence, secret exposure, ephemeral isolation, and recovery.
Secure GitHub Actions OIDC trust policies with bounded claims, immutable repository identity, protected environments, and cloud audit evidence.
Learn how software supply chain attacks compromise source, dependencies, builds, artifacts, and updates—and how producers and customers reduce the risk.
Control credentials across source, build, deployment, and runtime with scoped identities, short lifetimes, safe injection, monitoring, and rehearsed rotation.
Use provenance, signing, verification, and protected CI/CD identities to decide whether a software artifact can be trusted.
Use software bills of materials as maintained inventory evidence for component analysis, vulnerability triage, and supplier decisions.
