Supply chain hygiene is the practice of keeping software builds predictable, reviewable, and easier to trust. It means knowing where code comes from, limiting unnecessary dependencies, pinning versions, checking signatures or hashes, and maintaining a small, intentional trusted core. Good hygiene also includes clear package boundaries and regular review of what is allowed into a base system or release image.
In cyber security, this matters because attackers often target the software supply chain instead of a finished system. A malicious update, compromised dependency, or unreviewed build step can silently spread risk to every downstream user. Defenders use supply chain hygiene to reduce that exposure: fewer unknown components, fewer places for tampering, and a clearer audit trail when something changes. The goal is not just to build software, but to make its provenance and contents easier to verify.