#supply-chain

Supply chain: the attack you cannot code around

Why a vulnerability in someone else's dependency is still your production incident, and the concrete habits (lockfiles, audits, pinning) that limit the blast radius.