Software supply chain

Everything that contributes to a released artefact: dependencies, base images, build tools, the pipeline itself and the people with access to any of them. Attacks target it because compromising one widely-used link reaches everyone downstream, and because it is much less defended than production. The defences are dull and effective — pin versions, verify what you pull, build hermetically, sign what you publish, and know what is inside.