dear package registries (npm, composer, etc), i am begging yourequire 2FA before someone can tag a release RIGHT NOWthis would immediately stop a huge amount of the open source supply chain attacks we keep seeing
moat checks the things that are easy to miss 2FA, branch protection, signed commits, secret scanning, Dependabot, workflow permissions, pinned actions, webhooks, and moreavailable now: https://github.com/laravel/moat
@nunomaduro I'm glad you're here!I love your pint + phpstan projects, and use them daily for my federated TikTok project Loops (think Mastodon, but like TikTok powered by Laravel, Vue, Tailwind and React-Native)https://github.com/joinloops/loops-server
N
