Our final takeaway was from Nils Adermann, co-creator of a powerful tool we use called Composer. He gave an interesting talk about supply chain security, where he emphasised the importance of not only making our own code secure, but also the third-party code your own code depends on. Securing our own code is the first step, but many people forget about securing third-party code, so hackers often target this code first.
Composer manages the metadata of the third-party code used in projects, but pulls the code from the source, like GitHub, where there are lots of ways malicious attackers can control the code, such as GitHub Repo hijacking.
Nils goes on to talk about how a lot of these issues can be mitigated and minimised by using tools like Private Packagist in order to secure your own version of both the code and metadata, giving you total control of your security.