Learn Supply-Chain Guard: from zero to expert, then sell it

No AI background needed. Five levels, each with something to actually do, at your own pace. Tick items as you go (your ticks stay in this browser).

Evidence, proof and selling tools for Supply-Chain Guard

Level 1 Beginner: understand it

Coding agents install software packages. Some names they suggest don't exist, and attackers publish malware under those names or one-letter look-alikes.

The guard refuses fakes, look-alikes, untrusted sources and settings tampering, and asks a person when unsure.

Think of it like this: A pharmacist who checks every prescription: the medicine must exist, come from a licensed supplier, and not be a look-alike name.

Read the full plain-English explanation: Supply-Chain Guard, explained.

I read the explanation above.
I can say what it does in one sentence, without notes.

Level 2 User: see it work

Run it live: open the live demo. Before each result, guess what will happen. These are checks it must pass:

Control: ordinary installs and tests: Lockfile installs, pinned well-known packages and tests: all allowed.
The AI invents a package name (slopsquatting): Code models often suggest packages that don't exist; attackers register them. The invented package is refused.
Look-alike names: reqeusts, dj4ngo: Swapped and look-alike letters of popular packages are refused.
Agent switches on 'auto-approve' for itself: Modeled on a 2025 vulnerability where injected text made a coding assistant stop asking before running commands.
README says: download and run this script: A downloaded script run without review is refused, in all its spellings.
No registry to check: held for a person: Without a registry lookup the guard cannot tell a fake from a niche package, so it asks. Unknown never allows.

I ran the live demo.
I can explain what one of these checks shows.

Level 3 Verifier: prove it yourself

This is the skill that sets you apart: you don't have to believe us, and neither do your customers.

Install Python 3 if you don't have it (python.org/downloads).
Download the kit and unzip it.
Open a terminal in that folder. On Windows, click the folder's address bar, type cmd and press Enter. On a Mac, right-click the folder and choose New Terminal at Folder.
Run python3 verify.py (on Windows, python verify.py). It checks the seal without the internet.
Run python3 verify.py --live. It repeats every check from your own computer.
Try to cheat it: open transcript.json in a text editor, change one character, save, and run python3 verify.py again. It must now say FAIL. Unzip a fresh copy afterward.

I ran the kit's check on my own computer.
I changed a file and saw it fail.

Level 4 Expert: know the edges

An expert knows what a product does not do, and says it first. That is what makes a buyer trust you.

It checks installs and setting changes it is shown; an install that skips it is not checked.
It judges names, sources and commands; it does not read the code inside a package.
A package one letter from a popular one is sometimes real, so those are held for a person rather than refused.

You can say

Invented and look-alike packages are refused before install.
Unknown cases wait for a person.

Never say

"Scans package code for malware": it judges names, sources and commands.
"Stops every supply-chain attack".

Read the questions real buyers send, with honest answers: answers to buyer questions.

Test yourself (click a question to see the answer)

What is slopsquatting?

Malware published under names AIs invent.

What happens when the guard can't tell?

It asks a person.

In the live check "The AI invents a package name (slopsquatting)", what answer must come back, and why?

"SUPPLY_CHAIN_ATTACK_STOPPED". Code models often suggest packages that don't exist; attackers register them. The invented package is refused.

In the live check "Look-alike names: reqeusts, dj4ngo", what answer must come back, and why?

"SUPPLY_CHAIN_ATTACK_STOPPED". Swapped and look-alike letters of popular packages are refused.

In the live check "Agent switches on 'auto-approve' for itself", what answer must come back, and why?

"SUPPLY_CHAIN_ATTACK_STOPPED". Modeled on a 2025 vulnerability where injected text made a coding assistant stop asking before running commands.

Does a passing kit prove the product is safe for every possible input?

No. It proves what the live product answered to the inputs listed in the kit, and lets anyone check that again.

Has an independent party audited or certified this product?

No. No third-party audit is complete and no certification is held. Say so if asked.

I got every quiz question right without looking.
I can name one thing it does not do.
I explained it to a friend, and they understood it.

Want a formal study path? The CAIN Academy has courses and exams. Finishing this page is your own practice; it is not a qualification or certification.

Level 5 Seller: put it in front of a customer

Copy, paste, send: the shortest route, no technical skill needed.
Who buys it and where to find them.
The sales conversation, then the offer and the close.
The rules: read these before your first message.
Selling tools with this product's evidence built in: pitch, emails, call script, objection answers, one-pager.

I read the rules.
I sent my first personal message.

About money: your share is agreed in writing with FIRME AI CORPORATION before your first message (email vincent@firmeai.com). Nothing here promises income. Most messages get no reply; that is normal.