What is a common mistake with secure software supply chain in Cloud Security?

Scanning only application source while trusting dependencies, build runners, and unsigned images leaves major attack paths. In practice, the value of this concept comes from understanding where it belongs in the architecture, what problem it solves, and what constraints or tradeoffs it introduces.