Free course

Software Supply Chain Security Course

Secure dependencies, repositories, CI workflows, artifacts, releases, vulnerability handling, publishing authority, and dependency incident response.

5 modules · 25 lessons · No signup

Prerequisites: Security Fundamentals, Git and Testing JavaScript Applications

~~~

Your progress

of lessons completed.

Course completed.

What you'll learn

Trace and strengthen the complete path from dependency choice and source review through a verifiable artifact and controlled release.

Take this course offline

Subscribe to my newsletter to get every free book and course in PDF and EPUB format.

Get the downloads

Course contents

  1. Know what you build with

    Map dependencies, lock resolution, inspect package behavior, and choose trusted code deliberately.

    1. ✓ Map the dependency graph
    2. ✓ Use lockfiles deliberately
    3. ✓ Inspect package behavior
    4. ✓ Choose fewer, better dependencies
    5. ✓ Check your understanding: know what you build with

  2. Protect source and CI

    Control repository access, reviews, secrets, workflow permissions, and untrusted contributions.

    1. ✓ Protect repository access
    2. ✓ Require reviewed changes
    3. ✓ Keep secrets out of source
    4. ✓ Minimize CI authority
    5. ✓ Check your understanding: protect source and ci

  3. Build verifiable artifacts

    Use clean builds, SBOMs, provenance, signatures, and hardened container images.

    1. ✓ Build from clean inputs
    2. ✓ Create an SBOM
    3. ✓ Record provenance and signatures
    4. ✓ Harden container images
    5. ✓ Check your understanding: build verifiable artifacts

  4. Handle vulnerabilities

    Scan completely, triage reachability, patch transitive code, and coordinate disclosure.

    1. ✓ Scan the complete release
    2. ✓ Triage reachability and impact
    3. ✓ Patch transitive dependencies
    4. ✓ Publish a vulnerability policy
    5. ✓ Check your understanding: handle vulnerabilities

  5. Release and respond

    Protect publishing, verify deployment artifacts, and respond to compromised dependencies.

    1. ✓ Protect publishing authority
    2. ✓ Verify before deployment
    3. ✓ Respond to a dependency incident
    4. ✓ Complete the supply-chain review
    5. ✓ Check your understanding: release and respond