Supply Chain Security

Confining an agent's commands to a limited environment, so that a mistaken or hijacked action can only damage what the sandbox allows it to reach.

The store for the built outputs of software, such as packages, container images, and binaries, so the exact thing that was tested is the exact thing that ships.

Bots that open pull requests whenever a dependency releases a new version, how they keep upgrades small and security patches fast, and how they turn into noise or a supply-chain risk when misconfigured.

Small programs that modify the browser and the pages it shows, from bookmarklets and userscripts to ad blockers, with access broad enough to make them a standing security risk.

Reusing the outputs of build and test steps whose inputs haven't changed, keyed by a hash of those inputs, so large codebases build in minutes instead of hours.

Cryptographic attestation of an originating telephone number, and why spoofed calls survive it.

Cryptographically attesting who produced a binary, and the operating-system checks built on it.

Cryptographically signing Git commits so a commit's author can be verified rather than merely claimed, the key types used, and what a green verified badge does and does not prove.

A licensing strategy that uses copyright to require derivative works to stay open.

Loading a program's libraries at run time from shared files instead of copying them into the executable, which saves space and eases patching at the cost of fragile dependencies.

A SIM soldered into the device and provisioned over the air, with profiles downloaded rather than cards swapped.

The software built into hardware itself, running every keyboard, drive, and charger below the operating system, hard to inspect, risky to update, and a favorite hiding place for persistent malware.

A free implementation of the OpenPGP standard for encrypting and signing files, email, and software releases, descended from Phil Zimmermann's PGP and known both for its importance to software distribution and for being hard to use.

Granting only the permissions actually required, so a compromise has a small ceiling.

A generated file recording the exact dependency versions an install resolved to.

A release line that receives security and bug fixes for years instead of months, letting users who value stability skip the constant upgrade treadmill.

Several packages developed in one repository with shared tooling and atomic cross-package changes.

The tool that resolves, fetches, and installs dependencies, and pins them for reproducibility.

A license family that imposes little beyond attribution and a warranty disclaimer.

Untrusted content that reaches a model's context and is treated as instruction.

A JavaScript vulnerability where attacker-controlled keys like "__proto__" modify the prototype every object inherits from, silently adding properties everywhere, and how merge utilities and parsers let it in.

Storing, distributing, and rotating credentials without embedding them in code or history.

A version-numbering convention where the number communicates the kind of change.