Gate the NuGet packages your agent adds: a lock file, the audit, and a short script for what advisories miss

Sun, 01 Nov 2026 07:04:00 +0000

An agent is asked to add retry logic and comes back with a green build and a diff that includes one new line in a .csproj: a PackageReference to something with a plausible name. The build passes because the package exists. Nobody asks who published it, when, or what else came with it, because a 40-file diff has better places for the eye to go.

Nuget on Tokenise

Gate the NuGet packages your agent adds: a lock file, the audit, and a short script for what advisories miss