Supply chain attack mitigation?

[ratbag98]

Does Mason have any options to reduce the risk of supply chain attacks or does it just rely on upstream mechanisms?

For example, in mise I can use the install_before setting to prevent updates until the package has been out for a number of days: https://mise.jdx.dev/configuration/settings.html#install_before. By setting it to 7d for example I give the open-source-o-sphere plenty of time to spot the attacks and pull the code.

Thanks.