Still there’s supply chain attacks. How could you verify every dependency in a particular project perhaps?