CD-SEC-06 - Vulnerable and Untrusted Components
Nested sub-workflows and marketplace components inherit none of the parent app's security review.
Intent & Description
'
🎯 Intent
Prevent vulnerable and untrusted components from introducing security risks through nested dependencies.
📋 Context
Nested sub-workflows and marketplace components inherit none of the parent app’s security review, so one flawed component — human-built or AI-suggested — gets copy-pasted across an entire codebase or org. AI assistants compound this by sometimes hallucinating entire packages that don’t exist, which attackers can then register and weaponize.
💡 Solution
Apply the same security controls to sub-components as the core app. Document expected input/output and validation requirements for every sub-workflow. Maintain standardized, pre-vetted subcomponents for common functionality. Monitor for hallucinated packages. Implement component security review processes.'
Real-world Use Case
Source
📌 TL;DR
Secure all components including nested dependencies. Apply security controls to sub-components, use vetted libraries, and watch for hallucinated packages.
Advantages
- Prevents component vulnerabilities
- Enables component standardization
- Protects against package hallucination attacks
- Improves codebase security
Disadvantages
- Component maintenance overhead
- May limit marketplace flexibility
- Security review process adds time