Finally someone who gets ME! I maintain the Go SDK and leverage Snyk and GitHub to perform dependency checks. I’m mostly using the standard library but I like feeling like I have someone over my shoulder double checking things. I maintain the things built on top of the SDK as well like the Terraform provider so it’s really nice having the foundation and the building. No one else cares but I rewrote the back off/retry logic this week so folk don’t overload the API. Supply chain attacks are scary. I run as few dependencies as I can without having to reinvent the wheel. I’ve have spent so much time double checking package signing and key security it’s insane.