---
title: "Supply chain and integrity · vuejs.school"
description: "Use pnpm's release delay and build approval, check a package before you add it, pin CI actions to commits, verify CDN scripts and webhooks, and keep an SBOM ready for the next advisory."
canonical_url: "https://vuejs.school/learn/security/supply-chain-and-integrity"
meta:
  "og:description": "Use pnpm's release delay and build approval, check a package before you add it, pin CI actions to commits, verify CDN scripts and webhooks, and keep an SBOM ready for the next advisory."
  "og:image": "https://vuejs.school/_og/d/a_~U3VwcGx5IGNoYWluIGFuZCBpbnRlZ3JpdHkgwrcgdnVlanMuc2Nob29s%2Cc_OgCard.takumi%2Ctitle_Supply%2Bchain%2Band%2Bintegrity%2Cdescription_~VXNlIHBucG0ncyByZWxlYXNlIGRlbGF5IGFuZCBidWlsZCBhcHByb3ZhbCwgY2hlY2sgYSBwYWNrYWdlIGJlZm9yZSB5b3UgYWRkIGl0LCBwaW4gQ0kgYWN0aW9ucyB0byBjb21taXRzLCB2ZXJpZnkgQ0ROIHNjcmlwdHMgYW5kIHdlYmhvb2tzLCBhbmQga2VlcCBhbiBTQk9NIHJlYWR5IGZvciB0aGUgbmV4dCBhZHZpc29yeS4%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNiBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9zdXBwbHktY2hhaW4tYW5kLWludGVncml0eSI%2Cs_a8svzaCAq3aefnXL.png"
  "og:image:alt": "Supply chain and integrity · vuejs.school"
  "og:image:height": "600"
  "og:image:type": image/png
  "og:image:width": "1200"
  "og:title": "Supply chain and integrity · vuejs.school"
  "twitter:image": "https://vuejs.school/_og/d/a_~U3VwcGx5IGNoYWluIGFuZCBpbnRlZ3JpdHkgwrcgdnVlanMuc2Nob29s%2Cc_OgCard.takumi%2Ctitle_Supply%2Bchain%2Band%2Bintegrity%2Cdescription_~VXNlIHBucG0ncyByZWxlYXNlIGRlbGF5IGFuZCBidWlsZCBhcHByb3ZhbCwgY2hlY2sgYSBwYWNrYWdlIGJlZm9yZSB5b3UgYWRkIGl0LCBwaW4gQ0kgYWN0aW9ucyB0byBjb21taXRzLCB2ZXJpZnkgQ0ROIHNjcmlwdHMgYW5kIHdlYmhvb2tzLCBhbmQga2VlcCBhbiBTQk9NIHJlYWR5IGZvciB0aGUgbmV4dCBhZHZpc29yeS4%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNiBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9zdXBwbHktY2hhaW4tYW5kLWludGVncml0eSI%2Cs_a8svzaCAq3aefnXL.png"
  "twitter:image:alt": "Supply chain and integrity · vuejs.school"
---

> Index of every page on this site: [llms.txt](https://vuejs.school/llms.txt)

# **Supply chain and integrity**

Use pnpm's release delay and build approval, check a package before you add it, pin CI actions to commits, verify CDN scripts and webhooks, and keep an SBOM ready for the next advisory.

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://vuejs.school/#website","@type":"WebSite","description":"A free AI-instructed school for Vue.js. Short tutorials, runnable code and quizzes that adapt to you.","name":"vuejs.school","url":"https://vuejs.school/","publisher":{"@id":"https://vuejs.school/#identity"}},{"@id":"https://vuejs.school/learn/security/supply-chain-and-integrity#webpage","@type":"WebPage","description":"Use pnpm's release delay and build approval, check a package before you add it, pin CI actions to commits, verify CDN scripts and webhooks, and keep an SBOM ready for the next advisory.","name":"Supply chain and integrity","url":"https://vuejs.school/learn/security/supply-chain-and-integrity","breadcrumb":{"@id":"https://vuejs.school/learn/security/supply-chain-and-integrity#breadcrumb"},"isPartOf":{"@id":"https://vuejs.school/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://vuejs.school/learn/security/supply-chain-and-integrity"]}],"primaryImageOfPage":{"@id":"https://vuejs.school/#logo"}},{"@id":"https://vuejs.school/#identity","@type":"Organization","description":"A free AI-instructed school for Vue.js. Short tutorials, runnable code and quizzes that adapt to you.","name":"vuejs.school","url":"https://vuejs.school","logo":{"@id":"https://vuejs.school/#logo"}},{"@id":"https://vuejs.school/learn/security/supply-chain-and-integrity#article","description":"Use pnpm's release delay and build approval, check a package before you add it, pin CI actions to commits, verify CDN scripts and webhooks, and keep an SBOM ready for the next advisory.","headline":"Supply chain and integrity","inLanguage":"en","isAccessibleForFree":true,"thumbnailUrl":"https://vuejs.school/_og/d/a_~U3VwcGx5IGNoYWluIGFuZCBpbnRlZ3JpdHkgwrcgdnVlanMuc2Nob29s%2Cc_OgCard.takumi%2Ctitle_Supply%2Bchain%2Band%2Bintegrity%2Cdescription_~VXNlIHBucG0ncyByZWxlYXNlIGRlbGF5IGFuZCBidWlsZCBhcHByb3ZhbCwgY2hlY2sgYSBwYWNrYWdlIGJlZm9yZSB5b3UgYWRkIGl0LCBwaW4gQ0kgYWN0aW9ucyB0byBjb21taXRzLCB2ZXJpZnkgQ0ROIHNjcmlwdHMgYW5kIHdlYmhvb2tzLCBhbmQga2VlcCBhbiBTQk9NIHJlYWR5IGZvciB0aGUgbmV4dCBhZHZpc29yeS4%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNiBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9zdXBwbHktY2hhaW4tYW5kLWludGVncml0eSI%2Cs_a8svzaCAq3aefnXL.png","@type":["Article","TechArticle"],"articleSection":["Security"],"author":{"@id":"https://vuejs.school/#identity"},"image":{"@id":"https://vuejs.school/#/schema/image/1"},"isPartOf":{"@id":"https://vuejs.school/learn/security/supply-chain-and-integrity#webpage"},"keywords":["minimumReleaseAge","allowBuilds","pinned actions","Subresource Integrity","SBOM","webhook signatures"],"mainEntityOfPage":{"@id":"https://vuejs.school/learn/security/supply-chain-and-integrity#webpage"},"publisher":{"@id":"https://vuejs.school/#identity"}},{"@id":"https://vuejs.school/learn/security/supply-chain-and-integrity#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Skill tree","item":"https://vuejs.school/track","position":1},{"@type":"ListItem","name":"Security & OWASP","item":"https://vuejs.school/track/security","position":2},{"@type":"ListItem","name":"Supply chain and integrity","position":3}]},{"@id":"https://vuejs.school/#logo","@type":"ImageObject","caption":"vuejs.school","contentUrl":"https://vuejs.school/apple-touch-icon.png","inLanguage":"en","url":"https://vuejs.school/apple-touch-icon.png"},{"@id":"https://vuejs.school/#/schema/image/1","@type":"ImageObject","contentUrl":"https://vuejs.school/_og/d/a_~U3VwcGx5IGNoYWluIGFuZCBpbnRlZ3JpdHkgwrcgdnVlanMuc2Nob29s%2Cc_OgCard.takumi%2Ctitle_Supply%2Bchain%2Band%2Bintegrity%2Cdescription_~VXNlIHBucG0ncyByZWxlYXNlIGRlbGF5IGFuZCBidWlsZCBhcHByb3ZhbCwgY2hlY2sgYSBwYWNrYWdlIGJlZm9yZSB5b3UgYWRkIGl0LCBwaW4gQ0kgYWN0aW9ucyB0byBjb21taXRzLCB2ZXJpZnkgQ0ROIHNjcmlwdHMgYW5kIHdlYmhvb2tzLCBhbmQga2VlcCBhbiBTQk9NIHJlYWR5IGZvciB0aGUgbmV4dCBhZHZpc29yeS4%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNiBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9zdXBwbHktY2hhaW4tYW5kLWludGVncml0eSI%2Cs_a8svzaCAq3aefnXL.png","inLanguage":"en","url":"https://vuejs.school/_og/d/a_~U3VwcGx5IGNoYWluIGFuZCBpbnRlZ3JpdHkgwrcgdnVlanMuc2Nob29s%2Cc_OgCard.takumi%2Ctitle_Supply%2Bchain%2Band%2Bintegrity%2Cdescription_~VXNlIHBucG0ncyByZWxlYXNlIGRlbGF5IGFuZCBidWlsZCBhcHByb3ZhbCwgY2hlY2sgYSBwYWNrYWdlIGJlZm9yZSB5b3UgYWRkIGl0LCBwaW4gQ0kgYWN0aW9ucyB0byBjb21taXRzLCB2ZXJpZnkgQ0ROIHNjcmlwdHMgYW5kIHdlYmhvb2tzLCBhbmQga2VlcCBhbiBTQk9NIHJlYWR5IGZvciB0aGUgbmV4dCBhZHZpc29yeS4%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNiBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9zdXBwbHktY2hhaW4tYW5kLWludGVncml0eSI%2Cs_a8svzaCAq3aefnXL.png"}]}
```