Supply-chain security

Keep dependencies minimal, maintained, and from verified sources; respect lockfiles and review identity and compatibility before adding or upgrading packages.
Pin versions where appropriate and remove unused dependencies.
Treat plugins, build scripts, CI actions, and generated artifacts as part of the attack surface.
Use least privilege for build and deployment identities and never expose credentials in pipelines, logs, or artifacts.