Dependencies & Supply Chain

Software composition analysis (SCA)

Automated scan of package-lock.json, go.sum, etc. for known CVEs.

Dependabot / Renovate — PRs for upgrades; team must merge critical patches fast.

Lockfiles

Commit lockfiles — reproducible builds. CI installs from lock, not floating ranges.

Supply chain attacks (awareness)

• Typosquatting — lodash vs lodahs
• Compromised maintainer — event-stream incident pattern
• Build pipeline compromise — signed artifacts (SLSA levels)

Senior answer: "We pin deps, scan in CI, and use private registry proxy for npm/pypi."

SBOM (software bill of materials)

Inventory of components in release — increasingly required for enterprise sales.

Awareness sufficient for most SWE interviews.

Container images

Scan images (Trivy, Grype); minimal base images (distroless); don't run as root.

OS → Containers — isolation; this topic — image hygiene.

Pre-commit hooks

gitleaks, eslint security plugins — cheap wins.

Cross-reference: Observability → Alerting for paging on security events; not a substitute for prevention.