feat(config): validate clients and scope security

2026-09-14 01:07:46 +02:00
parent 5b0c623a8d
commit a3cee2756c
17 changed files with 230 additions and 437 deletions
@@ -0,0 +1,6 @@
+# Supply-chain security
+
+* Keep dependencies minimal, maintained, and from verified sources; respect lockfiles and review identity and compatibility before adding or upgrading packages.
+* Pin versions where appropriate and remove unused dependencies.
+* Treat plugins, build scripts, CI actions, and generated artifacts as part of the attack surface.
+* Use least privilege for build and deployment identities and never expose credentials in pipelines, logs, or artifacts.