You're viewing the readable version of this site. The interactive extras (search, diagrams, read-aloud) need JavaScript and a current browser. Enable JavaScript; if it is already enabled, update your browser.

Tag

Notes tagged “supply-chain”

Every note filed under supply-chain, newest first.

A filtered view of the notes.

2026

  1. Four Hundred Findings

    A scanner report is not a list of your vulnerabilities. It is a list of your dependencies crossed with a database — and about one in thirty is reachable from code you actually run.

    security vulnerabilities dependencies supply-chain tooling dissecting-systems

  2. You Don't Want Separate Repos

    Repository topology decides whether coupled code shares one content-addressed snapshot or negotiates version strings across a registry boundary.

    monorepo versioning git pnpm npm package-managers dependencies content-addressing modularity security supply-chain genkit sdk-design dissecting-systems