I didn't mean it was up to chance, it is technically quite hard to keep in check. At most places the most serious bit is some sort of compliance checks with ve

I didn't mean it was up to chance, it is technically quite hard to keep in check. At most places the most serious bit is some sort of compliance checks with vendors. And while that might carry legal consequences it's technically a pinky-promise. Nothing in the system enforces it in any way. Unless one does some technical analysis on every version of every deps one uses, a dep (maybe via one of its deps) can get compromised and how/when will anyone notice it? It is a technical challenge, and almost impossible for small devs. If you have a process in place to tackle this I'd love to learn about it, even if it has to stay in general terms.