Software Supply Chain Security
Software supply chain security is the practice of protecting every component, dependency, tool, and process used to build and deliver software — from third-party libraries to the build pipeline — so that malicious or vulnerable code cannot be introduced along the way.
Software supply chain security addresses the reality that modern applications are assembled from many parts a team did not write: open-source dependencies, base images, build tools, plugins, and third-party services. Each of these is a potential entry point, so the discipline aims to establish trust and integrity across the entire path from source code to deployed artifact.
Core practices include maintaining a software bill of materials (SBOM) to inventory every component, scanning dependencies for known vulnerabilities and malicious packages, pinning and verifying versions, signing artifacts, and generating build provenance. Public frameworks such as SLSA define graduated levels of supply-chain integrity, and standards bodies like NIST provide guidance on securing the development pipeline.
This matters because supply chain attacks — including dependency confusion, typosquatted packages, and compromised build systems — let a single malicious change propagate to many downstream users. Securing the supply chain reduces that blast radius and gives teams the evidence needed to answer "what is in our software and where did it come from?" when a new vulnerability is disclosed.