40. Component and software supply-chain security
Assess the risks of registry sources, generated commands, npm dependencies, copied code, and future component updates. Pin trusted sources, review diffs, audit packages, protect secrets, and establish approval rules for shared projects.