You Trust 1000 Strangers Every Time You Deploy

Tue, 18 Aug 2026 00:00:00 +0000

npm, PyPI, GitHub Actions, container registries — every layer of your supply chain was built on trust that no longer holds. The only question is whether you catch it before production or after.

Every modern application is mostly other people’s code. A typical project pulls in hundreds and thousands of transitive dependencies across npm, PyPI, Go modules, container base images, and GitHub Actions. Each one is a decision someone else made about what to run on your machine, in your CI, on your production servers.

Supply-Chain on Nitzan's Blog

You Trust 1000 Strangers Every Time You Deploy