We use Socket.dev to defend the software supply chain—proactively detecting malicious or risky open-source packages: typosquats, install-script abuse, obfuscated code, and hijacked maintainer releases, often before a CVE is ever published.
Socket.dev integrates into pull requests and CI, flagging dangerous dependency changes at review time so threats are caught before they reach production rather than after.
How We Use It
- Blocking malicious or typosquatted packages in pull requests
- Surfacing risky dependency behaviors (install scripts, network, filesystem access)
- Continuous supply-chain monitoring across the dependency graph
Auth & Security
Why this matters: Security is trust—modern auth and session practices protect users and keep compliance teams comfortable. Security is foundational. We standardize on modern auth, strong session management, and defense-in-depth controls to protect users and systems. Preferred defaults: BetterAuth for app auth, token-based sessions with rotation, 2FA (TOTP + WebAuthn), Arcjet for edge protection.