{
  "name": "003-happy-packaging-supply-chain",
  "task": "Our requirements.txt uses an extra-index-url to a private mirror alongside the public one and has no hashes. Is this dependency setup safe?",
  "tags": [
    "happy-path"
  ]
}