Your Stack Has One Point of Failure. It's the Tool You Trusted Most.

Three things hit Hacker News this week and they rhyme. A popular coding agent, ZCode, was caught silently uploading users' Git history to the cloud. Researchers chained a heap overflow and an SSO misconfiguration to reach OpenAI's internal repos. And Korea raised its data-breach fines to 10% of revenue — turning a compliance slip into a company-ending event.

None of these are exotic attacks. They're all the same failure: a business handed trust to a single dependency and never priced what that trust cost.

Free dependencies have a bill. You just don't see it yet.

Everyone running a cross-border store or a small SaaS is standing on borrowed ground. The CMS plugin nobody maintains. The free API that rate-limits you overnight. The "temporary" script from 2014 that, as one maintainer put it this week, ended up in 20 million installs — and is now being deprecated. The coding tool that looks convenient and is quietly shipping your source code somewhere else.

A single point of failure doesn't announce itself. It looks like convenience until the day it looks like catastrophe.

The audit that takes an afternoon

You don't need a security team. You need three honest lists.

1. List every external thing you depend on to ship. Payment, hosting, email, analytics, that one scraper, that one npm package. If it vanished tomorrow, what stops? Rank by blast radius, not by how often you think about it.

2. Label each one: owned, licensed, or borrowed. Owned means you control it. Licensed means you pay and have a contract. Borrowed means someone else's goodwill is holding your business up. The borrowed column is your real risk surface — and it's always longer than you expect.

3. Ask one question per borrowed item: does it touch money, customer data, or source code? If yes, it needs a boundary — least-privilege tokens, an egress allowlist, a self-hosted fallback, or a second vendor. If it can read your customers or your code, treat it exactly like a contractor with root access, because that's what it is.

The counterintuitive part

Security advice usually says add more: more tools, more scanning, more vendors. The cheaper move is subtraction. Every dependency you remove is risk you no longer have to monitor. A boring self-hosted script you understand beats a slick hosted agent you don't — especially when the hosted one has write access to your repos.

The ZCode lesson isn't "coding agents are bad." It's that you extended trust to a tool whose incentives you never verified. The OpenAI repo incident isn't "big companies are careless." It's that one misconfigured identity provider was enough.

The durable move

Pick the one dependency with the most privileged access to your business — the tool that can touch money, customer data, or code — and do two things this week: watch what it sends out, and write down what happens if it dies. An egress log and a one-page contingency plan cost an afternoon. A 10%-of-revenue fine, or a leaked repo, costs the company.

Free is not a price. It's a debt with a maturity date you didn't set. Know when it's due.