“Starts off with an open source policy, um, or SDLC policy, whatever you want it.”

Transcript evidence from Kyle Kelly -- The Dumpster Fire of Software Supply Chain Security.