SubQuery: Technical exposure and controls
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 16
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
Trace the exposure path
Use lockfiles and build evidence to identify exact artifacts and transitive paths. Establish where installation or execution occurred and which repository, publishing, cloud or service credentials were available there.
Build a small evidence map from the initiating dependency to the identities, business data and operations it can reach. Include indirect consumers and scheduled work. An inventory entry describes a possible path; activity logs and other account evidence are needed to establish what happened on that path.
Collect the right evidence
- Collect exact package identifiers, lockfiles and installation history across relevant pipelines.
- Inspect lockfiles and approved package metadata for direct and transitive exposure.
- Record asset identifiers, artifact or configuration versions, permission scope, evidence dates and the owner of each unresolved question. Do not include secret values.
Control and repair
Restrict affected execution paths, preserve package and build evidence and coordinate credential containment through clean administrative systems. Avoid running suspect lifecycle code while gathering routine package information.
Rebuild with reviewed dependencies and verified artifacts, replace exposed credentials after controlling their capture path and review repository and publishing activity for unauthorized changes.
Prove the boundary
Demonstrate the dependency path is removed or remediated, verify replacement build outputs and test revoked access. Record which distributed products were reviewed and how their integrity was assessed.
Use positive tests for the business function and negative tests for the access that should now be denied. Record which environment was tested and whether it represents production. Do not treat a successful login, clean homepage or healthy infrastructure graph as a substitute for an authorization or integrity test.
Engineering handoff
A reproducible build record and an explanation of how artifact integrity was established.
A dependency-to-environment-to-release evidence map.
Acceptance gate
Authorize releases only when the build environment, publishing identity and resulting artifacts have sufficient evidence of integrity.