Security and Supply Chain: Secrets · SBOM · SLSA · Dependencies

Today's products contain far more borrowed code and tools than code the team wrote itself. Attackers aim at the weakest link: dependency packages, CI actions, developer tokens.

Map of Attack Points

flowchart LR
    DEV[Developer accounts / tokens] --> SRC[Source Repository]
    DEP[External packages / actions] --> BLD[CI Build]
    SRC --> BLD
    BLD --> ART[Artifact / Registry]
    ART --> RUN[Production]
    SEC[Secret store] --> BLD
    SEC --> RUN

Every arrow is an attack path. Put defenses at the same points.

Learning from Real Incidents

npm had already made Trusted Publishing (OIDC) generally available on 2025-07-31, before the incident. After it, on 2025-11-05 npm capped write-enabled granular tokens at a 90-day maximum lifetime and set a 7-day default for new granular tokens, and on 2025-12-09 it revoked all remaining classic tokens. Publish with Trusted Publishing instead of long-lived tokens.

Managing Secrets

Bad:  Commit a .env file to the repository, and after the leak just revert the commit.
Good: Store it in a secret manager and inject it at runtime. If it leaks, "rotate", don't just "delete".

• A secret that has entered Git history once should be treated as already leaked.
• Since 2024-03 GitHub enables secret scanning and push protection by default on new public repositories owned by personal accounts. Push protection blocks pushes that contain supported secrets.
• For cloud access from CI, use short-lived tokens obtained via OIDC (document 03).

SBOM: What Is Inside

An SBOM (Software Bill of Materials) is a list of the components in a product. When a new vulnerability is announced, it lets you answer "do we ship this library?" within minutes.

• Main formats: SPDX and CycloneDX. Both are machine-processable.
• On 2026-07-29 US CISA and partners published the 2026 Minimum Elements for an SBOM, replacing the 2021 NTIA minimum elements. New elements include Component Hash Algorithm, Component License, SBOM Tool Name and SBOM Generation Context, and they apply to all software, including open source, AI software and SaaS.

SLSA: Who Built It, and How

SLSA is a specification that splits supply chain security into tracks and levels. v1.2, announced 2025-11-24, is the latest and is backward compatible with v1.1.

GitHub Artifact Attestations produce build provenance and, per GitHub's documentation, provide SLSA v1.0 Build Level 2.

Produce the SBOM and provenance together in the release build job.

permissions:
  contents: read
  id-token: write
  attestations: write
steps:
  - uses: actions/checkout@<commit-sha>
  - run: npm ci && npm run build
  - run: mkdir -p dist && tar -czf dist/app.tar.gz build
  - run: npm sbom --sbom-format cyclonedx > dist/sbom.cdx.json
  - uses: actions/attest-build-provenance@<commit-sha>
    with:
      subject-path: dist/app.tar.gz

• npm sbom builds a CycloneDX or SPDX SBOM from the installed dependencies. For mixed languages or container images, use a tool such as syft (syft <image> -o spdx-json).
• attest-build-provenance signs with an OIDC token (id-token: write) and stores the attestation with the attestations: write permission.

The consumer verifies before deploying.

gh attestation verify ./dist/app.tar.gz --repo my-org/my-app

Dependency Health

• Commit a lockfile and install exactly from it in CI (npm ci, etc.).
• Use tools such as Dependabot for vulnerability alerts and update PRs.
• OpenSSF Scorecard automatically checks an open source project's security practices (branch protection, signing, dependency management, etc.) and scores them 0–10. Check it before adopting a new dependency.

Regulation: EU Cyber Resilience Act

If you sell products with digital elements in the EU, check the CRA.

• From 2026-09-11 manufacturers must report actively exploited vulnerabilities and severe security incidents.
• Deadlines: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within 14 days after a corrective measure is available for vulnerabilities, or within one month of the notification for severe incidents.
• Reports go through ENISA's Single Reporting Platform. The remaining obligations apply from 2027-12-11.

Minimum Practice List

• 2FA on every account; tokens short-lived with least privilege
• Secret scanning / push protection enabled
• Lockfiles committed, dependency vulnerability alerts on
• CI actions pinned by SHA, workflow permissions minimized
• SBOM and provenance attached to release artifacts
• A vulnerability reporting channel (security policy) and response procedure documented

References

• Supply Chain Compromise of Third-Party tj-actions/changed-files — CISA, 2025-03-18, accessed 2026-09-28
• Widespread Supply Chain Compromise Impacting npm Ecosystem — CISA, 2025-09-23, accessed 2026-09-28
• npm trusted publishing with OIDC is generally available — GitHub Changelog, 2025-07-31, accessed 2026-09-28
• npm security update: Classic token creation disabled and granular token changes — GitHub Changelog, 2025-11-05, accessed 2026-09-28
• npm classic tokens revoked, session-based auth and CLI token management now available — GitHub Changelog, 2025-12-09, accessed 2026-09-28
• Secret scanning and push protection are enabled by default on new public repositories — GitHub Changelog, 2024-03-11, accessed 2026-09-28
• 2026 Minimum Elements for a Software Bill of Materials (SBOM) — CISA, 2026-07-29, accessed 2026-09-28
• Announcing SLSA v1.2 — SLSA, 2025-11-24, accessed 2026-09-28
• SLSA specification v1.2 — SLSA, accessed 2026-09-28
• Artifact attestations — GitHub Docs, accessed 2026-09-28
• OpenSSF Scorecard — OpenSSF, accessed 2026-09-28
• Cyber Resilience Act - Reporting obligations — European Commission, accessed 2026-09-28
• npm-sbom — npm Docs, accessed 2026-09-28
• Using artifact attestations to establish provenance for builds — GitHub Docs, accessed 2026-09-28
• actions/attest-build-provenance — GitHub, accessed 2026-09-28
• anchore/syft — Anchore, accessed 2026-09-28