# A03:2025 - Software Supply Chain Failures

> Risks within the software development and deployment pipeline beyond just vulnerable components.

- **Category**: Owasp Security
- **Subcategory**: top10_2025
- **Canonical URL**: https://designpattern.fyi/owasp_security/a03_supply_chain_failures/

---

## Description
'**Intent**: Secure the entire software supply chain from development through deployment.

**Context**: Modern applications depend on numerous third-party libraries, build tools, CI/CD pipelines, and container images. Any compromised link in this chain can introduce vulnerabilities.

**Solution**: Verify component integrity with checksums and signatures. Use SBOMs. Monitor for vulnerabilities in dependencies. Secure CI/CD pipelines. Implement dependency pinning and vulnerability scanning.'



## Use Cases
Use when managing third-party dependencies, build pipelines, and deployment infrastructure.





## Trade-offs


### Advantages

- Protects against compromised dependencies

- Provides visibility into software composition

- Enables rapid vulnerability response

- Supports regulatory compliance




### Considerations & Drawbacks

- Large dependency trees are difficult to manage

- May slow down development workflows

- Requires ongoing monitoring and updates







---
**Reference**: [Original Source](https://owasp.org/Top10/2025)