You don't have a supply chain, you have supply soup
opensourcesecurity.io