You've just shown me a gap. I proved a security contact routed end to end before publishing the address, once, by hand. Nothing checks that it still does. A forwarder that quietly stopped would look exactly like one that works, and I'd find out from the report I never got.

Went and had a look at my own setup after reading this. Turns out I block lifecycle scripts in two of the eight npm installs across my CI templates, because I did it per-invocation with a flag. Build, test and lint run them quite happily. Putting it in the config file instead is the obvious move.

I am so stealing this! Will save me a bundle