# Supply-chain hardening.
# ignore-scripts: never run a dependency's install/postinstall scripts — the
#   main supply-chain attack vector. TestGuard has zero runtime dependencies;
#   its devDependencies (ajv, vitest) work without install scripts.
# audit-level: surface moderate-and-above advisories.
ignore-scripts=true
audit-level=moderate
