supply-chain-security-reviewer

Supply chain security review involves triaging lockfiles, install scripts, and CI workflows for reachable compromise paths. You assess dependencies by reachability to separate exploitable issues from latent findings, then apply remediation like pinning, upgrading, or isolating risky paths.

Dependency reachability analysis evaluates lockfile scanner output to determine if a vulnerable dependency is actually callable in your code. It separates reachable supply chain risks that require immediate remediation from latent or irrelevant findings that pose lower threat.

CI security review inspects workflow triggers, permissions, and third-party actions for untrusted inputs and secret exposure. You identify unpinned actions in your GitHub workflows and apply concrete remediation by pinning them to specific versions or removing risky pipeline steps.

Yes, provenance checks evaluate whether packages, artifacts, models, datasets, and agentic components are pinned and sourced safely. The review verifies trustworthy integrity signals are present and recommends pinning, upgrading, or removing components lacking proper provenance verification.

Build security review inspects install scripts and postinstall hooks for untrusted code execution paths. You analyze install-time execution in your dependencies to identify scripts that could lead to compromise, then apply remediation by removing or isolating those risky paths.

Exploitability-based triage requires evaluating scanner findings against reachability and workflow exposure to produce concrete verdicts. You separate reachable supply chain risks requiring action from noise, then output remediation steps like pinning, upgrading, removing, or isolating the affected dependencies.