Troubleshooting

Security habits that help

Small habits that keep your code and your company safe.

• One token per place. A laptop token and a pipeline token, never shared, so one can be revoked alone.
• Short expiry. A token that expires in 90 days limits the damage if it leaks.
• Commit lock files. They pin exact versions, so a new malicious release cannot sneak in.
• Check names carefully. reqeusts is not requests. ForgeRepo™ warns about lookalike names, but read the name before you install.
• Walk the tree before adding a package. See Check before you install.
• Never turn off TLS checks to make an error go away.