# Supply-chain hardening.
# ignore-scripts: never run a dependency's install/postinstall scripts — the
#   main supply-chain attack vector. TestGuard's one runtime dependency (ajv)
#   and its devDependency (vitest) work without install scripts.
# audit-level: surface moderate-and-above advisories.
ignore-scripts=true
audit-level=moderate
