---
title: "Supply chain and setup · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup
updated: 2026-10-20
licence: "All rights reserved"
---

# Supply chain and setup

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Most attacks walk in through someone else's code or a forgotten setting. Pin what you use, keep it current and give every account only what it needs.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup`.

## Required

- [Lock and audit dependencies](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/audit-dependencies): Commit a lock file, install from it exactly, and fail the build on known holes in any dependency.
- [Review every new package](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/review-new-packages): Check every new dependency before adding it. Attackers publish packages with names close to popular ones, and take over abandoned ones.
- [Load third-party scripts with integrity checks](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/third-party-scripts): Host scripts yourself unless the provider requires its own server, such as a payment script. When a script must come from another server, pin its version and add an integrity hash.
- [Keep secrets out of builds from strangers](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/ci-secrets): Never give deploy keys or other secrets to builds that run code from outside contributors. Give each build job only the access it needs.
- [Remove defaults and samples](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/remove-defaults): Change every default password and remove sample apps, admin consoles and test pages before going live.
- [Keep software current and quiet](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/patch-and-hide-versions): Install security updates for the system, server and runtime within 7 days for critical or exploited holes, and within 30 days for the rest. Don't tell visitors which versions you run.
- [Log attacks without personal data](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/security-logging): Log failed logins, refused access and rate limit hits, and alert on spikes. Keep personal data out of the log.
- [Send the security headers](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/security-headers): Send the browser security headers on every page, including a strict Content Security Policy, HSTS and `nosniff`.
- [Remove DNS records you no longer use](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/dangling-dns): Delete every DNS record that points at a server, bucket or hosted service you no longer own, before you give that resource up.

## Recommended

- [Plan attacks before building](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/threat-model): Before building a feature, write down what an attacker would want from it and how they could get it. Then design those paths away.
- [Publish what is in each release](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance): Make a software bill of materials for every release, and sign where and how the build was made.
- [Wait a few days before taking new releases](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/release-cooldown): Install a new version of a dependency only after it has been public for at least 7 days. Security fixes you need now may skip the wait.

- Previous: [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits)
- Next: [AI agents and models](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models)
- [All chapters](https://agentwranglers.se/playbook/adversarial-testing)