Software supply chain security was hard enough. Then AI joined the build pipeline.
For five years, « software supply chain security » meant one question: what’s in your code? Which open-source packages, which versions, which transitive dependencies three layers deep that nobody chose on purpose?
SolarWinds, Log4Shell, and XZ Utils all taught the same lesson: the risk lives less in the code a