The build process is just as vulnerable.