The surveys speak: supply chain threats are freaking people out

This article synthesizes recent surveys (GitGuardian, ReversingLabs, Tidelift) showing that development secret leaks, vulnerable source code and open‑source dependency risks are widely perceived as major software supply‑chain threats; it highlights poor operational practices (plaintext secret sharing, reliance on manual reviews), gaps in investment and maturity for detection/mitigation, and calls for structural fixes such as secure‑by‑design, SBOMs and better support for open‑source maintainers.