Security
Supply-Chain Integrity for Small Engineering Teams
Most supply-chain security advice assumes a security team you do not have. Here is what is worth doing anyway.
Supply-chain security guidance is usually written for organizations with a dedicated security team, which makes most of it impractical advice for a five-person engineering team shipping every week.
What is actually worth the time
- Pin dependency versions and review diffs on updates, rather than auto-updating everything.
- Enable provenance attestation on your build pipeline if your package registry supports it — most now do, and it is close to free.
- Separate publish credentials from developer credentials, even on a small team, so a compromised laptop cannot ship a malicious release.
What to skip for now
Full SBOM generation and dependency scanning tooling pay off at a scale most small teams have not reached yet. Do the identity and pipeline hygiene first — it is cheaper and closes the more likely attack path.