# Supply-chain security

* Keep dependencies minimal, maintained, and from verified sources; respect lockfiles and review identity and compatibility before adding or upgrading packages.
* Verify package identity, source, maintainer, release history, transitive dependencies, and install-time behavior. Treat typosquats and unexpected ownership changes as risks.
* Pin or constrain versions according to project policy, commit lockfiles, and remove unused dependencies. Review lockfile changes instead of hand-editing generated entries.
* Review dependency and build-tool updates for breaking behavior and security advisories; upgrade deliberately and verify the resulting artifact.
* Treat plugins, build scripts, CI actions, compiler plugins, generated artifacts, and caches as part of the attack surface. Pin CI actions to reviewed immutable revisions where supported.
* Use least-privilege build and deployment identities. Separate untrusted pull-request jobs from secret-bearing jobs and protect release credentials from untrusted code.
* Never expose credentials in pipelines, logs, caches, artifacts, command output, or generated packages. Limit secret lifetime and scope.
* Verify artifact provenance and integrity before release or installation; avoid downloading and executing unverified content dynamically.