Vet every release before it reaches your builds.

• Per-version cooldown & approval queue
• Security holds on compromised upstreams
• Scoped, deprovisionable credentials