The Supply Chain of Code
Modern web development is often an exercise in assembly rather than creation. A typical site might depend on:
- Google Fonts (Typography)
- Amazon AWS (Hosting)
- Cloudflare (DNS/Security)
- Stripe (Payments)
- Twitter/Facebook (Authentication)
Each of these is a dependency. Dependency Risk is the calculation of what happens when one of them fails, changes its terms of service, or raises its price.
The Third Party Trap
Dependency Risk is invisible until it's fatal. It operates on the "Tethered" principle: functionality is rented, not owned. A site with high dependency risk is not a sovereign structure; it is a temporary encampment on someone else's property.
Field Notes
Left-Pad Incident: In 2016, a single developer deleted a tiny 11-line code package called "left-pad" from the npm registry. Thousands of major websites broke instantly. This was a masterclass in Dependency Risk.