1 min lesson
Secrets, dependencies & supply chain
Name the key items in "Secrets, dependencies & supply chain", then explain why each one matters.
Step 1 of 3
The fastest way into a company isn't a clever exploit - it's a leaked key in a git history or a backdoored dependency you installed yourself. Supply-chain and secrets review is high-impact because the failure mode is total.
Learn more
Advanced table
Dependency and supply-chain risk
Dependency and supply-chain riskyour code is mostly other people's code
- Risk
- Vulnerable dependency
- What it looks like
- A known CVE in a package you pull in directly
- Control
npm audit/pip-audit/ Dependabot; patch on a cadence
- Risk
- Transitive risk
- What it looks like
- The vuln is three levels down, not in your manifest
- Control
- SBOMSoftware Bill of Materials. A list of every component and dependency in a build, like an ingredients label for software. Press Enter for the full definition. to see the full tree; lockfiles to pin every level
- Risk
- Unpinned versions
- What it looks like
^1.2.0silently pulls a compromised 1.9.0- Control
- Pin exact versions + lockfile + integrity hashes
- Risk
- Build-pipeline tampering
- What it looks like
- Malicious code injected during build, not in source
- Control
- Hermetic, reproducible builds; signed artifacts; provenance
| Risk | What it looks like | Control |
|---|---|---|
| Vulnerable dependency | A known CVE in a package you pull in directly | npm audit / pip-audit / Dependabot; patch on a cadence |
| Transitive risk | The vuln is three levels down, not in your manifest | SBOMSoftware Bill of Materials. A list of every component and dependency in a build, like an ingredients label for software. Press Enter for the full definition. to see the full tree; lockfiles to pin every level |
| Unpinned versions | ^1.2.0 silently pulls a compromised 1.9.0 | Pin exact versions + lockfile + integrity hashes |
| Build-pipeline tampering | Malicious code injected during build, not in source | Hermetic, reproducible builds; signed artifacts; provenance |
Most of your attack surface is dependencies you never read. SBOM + pinning make it visible and stable.
SolarWinds wasn't a vuln in shipped source - attackers compromised the build pipeline and injected a backdoor into a signed, trusted update that thousands of customers installed. The lesson for review: the build system is part of your trust boundary. A clean codebase that's built on a machine anyone can SSH into, from dependencies pulled at build time over plain HTTP, is not actually trustworthy. Treat CI as production.