supply-chain

Choosing an AI developer tool without vendor security questions invites supply-chain surprises. Use these ten prompts — build hygiene, disclosure culture, telemetry, SBOM — before you standardise an AI developer tool across your team.

An AI vendor security incident on a tool you depend on is still your governance problem. This practical guide helps small teams assess scope, rotate credentials, update threat models, and document decisions — without waiting for confirmed harm.

Anthropic's Claude Code source code was accidentally exposed via a .map file in their npm registry. Here's what the leak reveals and what small teams should learn about AI vendor security and governance.