Supply chain security: dependency confusion, SBOM and provenance verification, artifact signing, build-pipeline secret hygiene, and malicious package review.
50 checks · progress and notes saved in your browser
What actually enters the build from outside the organization’s own code — the full dependency graph across every package ecosystem in use, and whether an accurate, retained SBOM exists to answer "were we affected by CVE-X" in minutes, not days.
Attacks that exploit how package managers resolve names — getting the build to pull an attacker-controlled package instead of the intended one, whether through internal-namespace collision or a one-character name trick.
Whether a dependency itself — not a known CVE, but arbitrary code shipped by its author or a compromised maintainer — can execute during install or at runtime, and whether the organization would notice.
Whether an artifact can be proven to have come from the expected source, built by the expected pipeline, and unmodified since — the SLSA framework’s core question — and whether that proof is actually signed and checked, not just published alongside.
The blast radius when a dependency turns out to be malicious — what a compromised install script can reach on the build runner — and the highest-leverage attack of all: taking over the account that publishes the organization’s own packages.
Whether the exact, reviewed set of dependency versions and hashes actually gets installed deterministically, or whether the build can silently drift to different code than what was reviewed and approved.