Dependency Management

This post walks through five layers you can add to a repo where coding agents open PRs so hallucinated or slopsquatted dependencies get caught: a single internal registry, a structured dependency block, a read-only CI verifier, risk tiers and an org-wide first-seen ledger, along with what each layer catches and misses.