Well it would be interesting to have the numbers, to know how important it is to focus on defending uploads from CI vs uploads from developer machines. > PyPI

Well it would be interesting to have the numbers, to know how important it is to focus on defending uploads from CI vs uploads from developer machines. > PyPI allows you to create project scoped tokens It requires the creation of a non-scoped token first, to do that. And since people are lazy I'd bet many have not created a scoped token. Again, this is supposition from my part that could be verified or proven wrong by you.