Treat dependencies and build artifacts as part of the security boundary

Software security includes more than application code. Dependencies, build inputs, secrets, artifacts, update practices and deployment paths all influence what reaches production.

Dependency inventory

Know the direct and important transitive dependencies that enter the build and runtime environment.

Version control

Use explicit version constraints and reviewed update practices rather than silently drifting dependency sets.

Source & provenance

Know where build inputs come from and prefer verifiable, maintained sources over unreviewed copies.

Secrets separation

Keep credentials, signing material and deployment secrets outside source code and generated artifacts.

Build isolation

Separate trusted build/release work from ad-hoc developer state where practical for the project.

Artifact integrity

Preserve traceability from reviewed source to the artifact that is actually deployed or distributed.

Update handling

Treat dependency updates as changes requiring testing, compatibility review and security awareness.

Rollback & recovery

Keep a practical path to revert or replace a problematic release or dependency when the real environment permits it.

Run Release Readiness DevSecOpsSecure Software LifecycleThreat Modeling

This guidance does not claim software-bill-of-materials completeness, artifact attestation, supply-chain certification or vulnerability-free dependencies for any specific project.