Dependency and supply-chain security

Backend security Senior Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Pick the fix

Your CI uses uses: some/action@v2. The maintainer's account is compromised. What would have protected you?

Options
Hint 1 of 1

Can a tag be moved?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Pinning the action to a full commit SHA and reviewing updates

Correct. A moved tag can't change a pinned commit.

A tag like v2 is a movable pointer, so whoever controls the repo can point it at new code. A full commit SHA names exact content, so a compromised maintainer can't change what you run.

Why not the others?
  • B Using @main instead. Even more exposed.
  • C More CI runners. Unrelated.
  • D Running tests twice. The malicious step still runs.

30-second answer

Pin exact versions with a lock file and hashes, update deliberately with automated pull requests, and scan for known vulnerabilities (pip-audit, OSV, Dependabot). Watch for typosquatted and newly hijacked packages; prefer well-maintained ones. Lock down CI: least-privilege tokens, pinned actions by commit, protected branches and reviewed changes. Produce an SBOM and sign build artifacts so you can trace and verify what runs in production.

Practise saying it · 30 s. No recording, just a timer

Supply chain.

Say your answer out loud, then check which of these points you covered:

  • Lock files with hashes
  • Scan and update
  • Vet packages
  • Harden CI
  • SBOM, signing

Deep dive

pip install --require-hashes refuses packages that don't match the lock file.

SLSA levels describe build provenance maturity.

Minimal base images reduce what can be exploited.

Remove unused dependencies; each one is attack surface.

Common mistakes

  • Unpinned latest dependencies in production builds.
  • CI tokens with write access to everything.
  • Ignoring scanner alerts until a breach.

Senior take & follow-ups

Lock and hash, scan and update, vet packages, harden CI, SBOM and signing.

Follow-up questions

Think of your answer first, then open the hint.

  1. What's an SBOM?

    Show hint

    A list of every component and version in a build.

  2. Why pin CI actions by commit?

    Show hint

    A tag can be moved to malicious code.

Related questions

Suggest a fix if something here is wrong or out of date.