ObsidianFrom the builder

Less is safer: how Obsidian reduces the risk of supply chain attacks

Obsidian explains how it limits supply chain attack risk, chiefly by avoiding third-party code: features like Bases and Canvas were written from scratch, small utilities are reimplemented, mid-sized modules are forked in when licenses permit and large libraries are vendored at locked versions. Every dependency is pinned with a committed lockfile, postinstall scripts never run, upgrades involve line-by-line changelog reading, sub-dependency checks and testing, and a delay separates any upgrade from a release. Obsidian says no measure removes the risk entirely, but together these make an impact far less likely.

Official blogSep 19, 20252 min read