26zl Supply-chain and product-security hardening
Use this skill for SDLC, build/release pipelines, dependency trust, artifact provenance, product security, and supply-chain risk reduction.
Workflow
- Map the product delivery path:
- source repositories
- developer identities
- CI runners
- dependency sources
- build steps
- artifact registries
- deployment targets
- Identify trust decisions:
- who can merge
- who can release
- what dependencies are allowed
- where secrets live
- which artifacts are trusted
- Add controls in priority order:
- branch protection and required reviews
- pinned dependencies and lockfiles
- dependency update policy
- SBOM generation and retention
- vulnerability and license gates
- provenance attestation
- artifact signing and verification
- isolated, ephemeral build runners
- least-privilege CI tokens
- secret scanning and rotation
- Validate with a release rehearsal: can an untrusted change, dependency, runner, or artifact reach production?
Output pattern
| Stage | Weakness | Attack path | Control | Evidence | Owner | Priority |
|---|
Prefer controls that are enforceable in CI/CD or registry policy over wiki-only process.