How can an upstream bug turn into a vulnerability? Sandboxing Secure communication (confidentiality, integrity, authentication) Controlling access (authentication, authorization, least privilege) Social engineering