2025 Was Quietly Good for Application Security

The report surveys six 2025 advances that strengthened software supply-chain security and developer safety: tougher npm/GitHub controls (mandatory 2FA, trusted publishing via short‑lived tokens, removal of legacy tokens, and faster coordinated takedowns), safer-by-default developer tooling and reduced default permissions, new GitHub constraints to blunt malicious pull requests, broader adoption of a shared “supply chain risk” language to drive SDLC improvements, greater cross‑organization researcher collaboration, and reduced reliance on a single government’s vulnerability programs via initiatives like the CVE Foundation, EUVD, and OSV.