What is a common mistake with secure software supply chain in Cloud Security?

Scanning only application source while trusting dependencies, build runners, and unsigned images leaves major attack paths.