Dependency and supply chain risk

Most of your production code came from someone else. Lockfiles, audits, and update discipline are what keep that manageable.

14m
Intermediate

Video thumbnail for Dependency and supply chain risk

Video by Aikido Security · YouTube

Check your understanding

3 questions. Unlocks when you finish the video.

Overview

What this lesson covers

Pin dependencies with a committed lockfile
Audit for known vulnerabilities continuously
Review what a new dependency actually pulls in

This lesson sits in Hardening and Supply Chain, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will:

Pin dependencies with a committed lockfile
Audit for known vulnerabilities continuously
Review what a new dependency actually pulls in

Resources

OWASP Top 10The official reference for the tools used in this lesson.