Less is safer: How Obsidian reduces the risk of supply chain attacks

Was hoping they outlined their approach to handling potentially compromised packages running on dev machines prior to even shipping. That seems like a much harder problem to solve.