Supply Chain Gate

Keep merges and publishes policy-clean under Socket + npm audit — not chase literal 100s on every package-health gauge when the product needs fs / spawn.

Principles

• Gates over vanity scores — block malware, install scripts, exotic deps; monitor expected CLI capabilities (filesystem, shell for create-adsk).
• Evidence first — read the Socket PR comment / Alerts list before changing code.
• No new High risk without justification — document in the PR if you must.
• Pins for published packages — exact versions on create-adsk production deps.

Procedure

1. Classify the ask