The software supply chain begins long before code reaches a repository, build pipeline, or production environment. It begins on the developer workstation. Developers routinely interact with source code, cloud infrastructure, package ecosystems, AI coding assistants, and deployment platforms, creating a concentration of trust few other enterprise users possess. Yet most organizations still secure developer devices with tools and policies designed for general-purpose corporate endpoints. The result is a critical visibility gap. Security teams can see what reaches repositories and pipelines, but often lack insight into the tools, dependencies, AI interactions, and trust decisions that shape code before it is committed. That blind spot creates a new supply chain attack surface hiding in plain sight. In this session, we’ll explore why developer workstations have become a critical part of the software supply chain, how attackers exploit this trust, where traditional endpoint security falls short, and how organizations can improve visibility and control without disrupting developer productivity.