Supply-chain risk in your trading stack

A modern trading system is assembled far more than it is written. Beneath your strategy sits a deep stack of open-source libraries, container base images, build tools, and vendor SDKs, thousands of components authored by people you will never meet. Every one of them runs with your system’s privileges. Supply-chain risk is the recognition that an attacker does not need to breach you if they can breach something you already trust and pull in automatically.

§01The dependency you never audited

The classic vector is a compromised package: a popular library gains a malicious update, or an attacker publishes a lookalike name a developer installs by typo. Because dependencies pull in their own dependencies, a single poisoned package deep in the tree inherits the access of the whole application, including, potentially, the credentials that move money. The danger is not the code you reviewed; it is the transitive code you never saw arrive.

§02Pin, verify, and generate a bill of materials

The defences are concrete. Pin dependencies to exact, hash-verified versions so a build cannot silently pull something new. Maintain a software bill of materials, an inventory of every component and version, so that when a vulnerability is disclosed you can answer "are we affected" in minutes rather than days. Verify signatures on packages and images where the ecosystem supports it, so provenance is proven rather than assumed. The goal is that nothing enters the build you cannot name and trace.

§03Harden the pipeline itself

The build system is a high-value target because it produces the artefact that runs in production with full trust. A pipeline that pulls arbitrary code, holds broad credentials, and deploys without review is a single point of compromise. Isolate build environments, scope their secrets narrowly, and make the path from source to production reviewable and reproducible, the same change discipline you apply to strategy code applies to the machinery that ships it.

§04Trust, established not assumed

Supply-chain security reframes a comfortable assumption: that the code you depend on is safe because it is popular. Popularity is not provenance. Inventory what you run, verify where it came from, and harden the pipeline that assembles it. This advisory is educational and illustrative and is not security advice for any specific system.