Supply-chain security

Package protection

The registry checks package metadata, quarantine age and scan verdicts before serving eligible artifacts from its own stored copy. A held or blocked package is not a guarantee about any other package. Policy exceptions and direct installs outside the registry have their own risks.

The service's own dependencies

Our supply-chain policy pins dependencies and records an allowlist; dependency changes undergo checks and audit. Untrusted package and scanner execution is isolated in a sandbox. These practices reduce risk, but cannot eliminate it. CDN delivery and public provenance guarantees are not available today.