Supply Chain Security
Dependency governance, vulnerability response SLAs, and build integrity controls.
Dependency Governance
Approval Process
- New deps — review: package size, maintenance status, license (MIT/Apache 2.0/ISC), download count, CVEs
- Security-critical (auth, crypto, payment SDKs) — pinned to exact versions, no
^or~ - Transitive risks —
npm run security:auditin CI + weekly Dependabot scans
Approved Packages
| Category | Packages | Version Policy |
|---|---|---|
| Auth/Crypto | @supabase/ssr, @supabase/supabase-js | Exact pin |
| Payments | stripe, @polar-sh/sdk, @lemonsqueezy/lemonsqueezy.js | Exact pin |
| Database | drizzle-orm, drizzle-kit, postgres | Exact pin |
| Framework | next, react, react-dom | Minor range (~) |
| UI | @radix-ui/*, shadcn components | Patch range |
| Dev tools | vitest, eslint, typescript | Latest minor |
️ Vulnerability Response SLA
| Severity | Response | Action |
|---|---|---|
| Critical (CVSS 9.0+) | 24 hours | Patch, rebuild, deploy |
| High (CVSS 7.0–8.9) | 7 days | Patch in next release |
| Medium (CVSS 4.0–6.9) | 30 days | Patch when convenient |
| Low (CVSS 0.1–3.9) | Next sprint | Evaluate and patch |
Automated Controls
| Control | Tool | Trigger |
|---|---|---|
| Vulnerability scan | npm run security:audit | Every CI run |
| SBOM generation | @cyclonedx/cyclonedx-npm | Every CI run (90-day retention) |
| Dependency updates | Dependabot | Weekly PRs |
| Lockfile integrity | npm ci (not npm install) | Every CI run |
| Version pinning | .npmrc (engine-strict=true) | Every install |
Lockfile Policy
- CI/CD —
npm cionly. Fails ifpackage-lock.jsonmismatchespackage.json. - Local dev —
npm installnormally. Commitpackage-lock.jsonchanges. - Never —
npm install --forceor--legacy-peer-depswithout documented justification.
SBOM
Generated every CI run via CycloneDX (@cyclonedx/cyclonedx-npm@^4.2.1 devDependency):
npm run sbom
# Equivalent to: cyclonedx-npm --output-file sbom.json --output-reproducible- Format: CycloneDX JSON (reproducible output)
- Retention: 90 days (GitHub Actions artifact)
- Contents: all production + dev dependencies with versions and licenses
- Access: GitHub Actions → workflow run → Artifacts
- Local:
sbom.jsonin project root (gitignored)
Incident Response
Critical dependency vulnerability discovered:
- Check if vulnerable code path is reachable in our codebase
- Reachable → patch immediately, deploy within 24 hours
- Not reachable → document finding, patch within 7 days
- Log in
auth_eventsfor audit trail
Copyright © 2026 Vibe44. Built with ❤️ by Scale with Alap.