# Supply-Chain Security Hardening
# Applied: 2026-05-14T14:19:27Z
# ignore-scripts: never run a dependency's install/postinstall scripts (the main
#   supply-chain attack vector). Universally supported across npm versions.
# audit-level: surface moderate-and-above advisories.
#
# NOTE: `min-release-age=7d` was removed 2026-07-06 — newer npm (Node 22+/npm 11+,
# as used by the Glama MCP build image) rejects the "7d" value ("must be numeric")
# and HARD-FAILS `npm install` in clean environments (Glama, CI, fresh clones).
# DocGuard's single runtime dependency is exact-pinned, so the maturity window
# added little; the exact pin + ignore-scripts + audit-level remain the controls.
ignore-scripts=true
audit-level=moderate
