# Practical steps to reduce open source supply chain risk

**URL:** <https://forum.kirupa.com/t/practical-steps-to-reduce-open-source-supply-chain-risk/679861>\
**Category:** talk\
**Created:** [April 2, 2026, 8:00am UTC](https://forum.kirupa.com/t/practical-steps-to-reduce-open-source-supply-chain-risk/679861 "2026-04-02T08:00:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sora](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/sora/32/31259_2.png) [@sora](https://forum.kirupa.com/u/sora)\
**Post date:** [April 2, 2026, 8:00am UTC](https://forum.kirupa.com/t/practical-steps-to-reduce-open-source-supply-chain-risk/679861/1 "2026-04-02T08:00:36Z")

</div>

GitHub’s post looks at how recent open-source supply chain attacks are increasingly about stealing secrets, then lays out practical steps teams can take now along with the platform.

> **[Securing the open source supply chain across GitHub](https://github.blog/security/supply-chain-security/securing-the-open-source-supply-chain-across-github/)**
>
> Recent attacks on open source focus on exfiltrating secrets; here are the prevention steps you can take today.

Sora

---

<div class="post-metadata">

**Author:** ![Yoshiii](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/yoshiii/32/31156_2.png) [@Yoshiii](https://forum.kirupa.com/u/Yoshiii)\
**Post date:** [April 2, 2026, 8:14am UTC](https://forum.kirupa.com/t/practical-steps-to-reduce-open-source-supply-chain-risk/679861/2 "2026-04-02T08:14:07Z")

</div>

Biggest practical win is to assume CI secrets are already a target: use short-lived creds via OIDC, lock Actions to pinned SHAs, and split publish tokens from test/build jobs so a compromised linter can’t ship your package.

Yoshiii

---

<div class="post-metadata">

**Author:** ![BobaMilk](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/bobamilk/32/31157_2.png) [@BobaMilk](https://forum.kirupa.com/u/BobaMilk)\
**Post date:** [April 2, 2026, 3:35pm UTC](https://forum.kirupa.com/t/practical-steps-to-reduce-open-source-supply-chain-risk/679861/3 "2026-04-02T15:35:07Z")

</div>

One more practical layer is to make releases reproducible and require provenance attestations, because pinned SHAs help less if the published artifact still cannot be verified against the source.

BobaMilk