Secure your supply chain

Developers ranked Software Supply Chain Failures the #1 risk in OWASP's 2025 community survey — roughly half of respondents put it first. It's the modern successor to "using components with known vulnerabilities," widened to cover anything that can go wrong while you build, distribute, or update software: a vulnerable dependency, an unpinned CI/CD action, a leaked token.

The 2025 Shai-Hulud npm worm is the real-world version of this: a self-propagating package that harvested developer secrets and npm tokens as it spread. SolarWinds and Log4Shell are the two other names people already know.

What actually protects you

• Track your dependencies — know every package you ship, including transitive ones (an SBOM helps).
• Keep them current — Dependabot opens a PR the moment an advisory lands.
• Pin your Actions — reference third-party GitHub Actions by full commit SHA, not a floating tag or branch.
• Least-privilege your tokens — grant a workflow only the permissions the job needs.
• Never commit secrets — and turn on push protection so a slip never reaches the remote.

None of this requires exotic tooling — it's Dependabot, dependency review, secret scanning, and a little care in how you write workflow YAML. SeeFollow the demonstration for the complete lifecycle.

Episode 3 takeaway: protect the whole path from source to production, not only the packages in your application.