Agree that every dependency is a new org to trust. I’m very interested in ways to identify high quality+security libraries and orgs. Simply saying “I am willi

Agree that every dependency is a new org to trust. I’m very interested in ways to identify high quality+security libraries and orgs. Simply saying “I am willing to rewrite everything from scratch” doesn’t work. Finding the best way to work with the existing ecosystem is more or less a requirement for most companies/projects.