How Supabase Prevents Supply Chain Attacks Without Slowing Developers

AI coding tools have made it possible for anyone to build software, which means open-source code is entering companies through far more paths. Developers, coding agents, CI systems, and business users building internal tools can all pull packages directly from public registries.

A supply chain attack can begin before anything reaches code review or production. Malicious install scripts can execute as soon as a package is downloaded, giving attackers a way to steal credentials, exfiltrate source code, or plant a backdoor. Tools that depend on signatures and reputation may miss a novel package until someone has already identified it as malicious.

Preventing these attacks requires checking every package before installation, regardless of who or what requested it. Developers and agents should be able to keep using the same install commands, while security teams block malware and enforce policies without adding manual review to every download.

Join Kal Ramkumar (Founding Solutions Engineer), James McLean (Head of Product), and Etienne Stalmans (Security Engineer at Supabase) to learn how Supabase protects its software supply chain while preserving developer velocity.

In this webinar, you’ll learn how to:

• Identify and reduce risk across open source dependencies and the software supply chain
• Build security controls into developer workflows without creating unnecessary friction
• Help engineering teams move quickly while maintaining a strong security posture

What we’ll show

• A malicious package being published and blocked before it reaches any environment
• How depthfirst detects novel malware
• How the Dependency Firewall enforces policies across every install path
• How security controls are implemented without slowing down developers

Who should attend

• AppSec professionals
• Security engineering leaders
• Product security teams
• CISOs and technical security leaders responsible for AI governance