Code and infrastructure that do not protect against integrity violations: unsigned updates, insecure deserialization, untrusted CI/CD plugins.