SupplyGuard

Dependencies move faster than any team can read them. The upgrade that becomes an incident is never the one anybody discussed, it is the patch bump nobody opened. SupplyGuard watches what is changing underneath a repository and flags what deserves a human. It stores no source code, which was the first decision and not a negotiable one: a tool asking for repository access has to be able to answer what it keeps, and the only answer that survives a security review is nothing.

It reads dependency metadata and nothing else. No source code is fetched and none is stored, so the worst case if I am ever breached is a list of package names.