Lesson 4.3
Dependency and supply chain risk
Most of your production code came from someone else. Lockfiles, audits, and update discipline are what keep that manageable.
13mIntermediate5,728 students
Sign in to watch this lesson
Browsing is free. Create an account to play videos and track your progress.
Overview
Most of your production code came from someone else. Lockfiles, audits, and update discipline are what keep that manageable.
What this lesson covers
- Pin dependencies with a committed lockfile
- Audit for known vulnerabilities continuously
- Review what a new dependency actually pulls in
This lesson sits in Hardening and Supply Chain, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.
In this lesson you will:
- Pin dependencies with a committed lockfile
- Audit for known vulnerabilities continuously
- Review what a new dependency actually pulls in