.env.example says DATABASE_URL=postgres://localhost:5432/app. The compose file the team uses for local work mounts a volume and sets DATABASE_URL=sqlite:///data/app.db. The CI workflow exports DB_URL, a name the code stopped reading two refactors ago. Production has a secret called DATABASE_URL that nobody has looked at since the last rotation. Each of those files is valid, and every linter you could point at them passes them. The app still behaves differently on three machines, and the first person to find out is whoever is on call.

Run npm ls --all on a mid-sized web app and you get a tree that scrolls for pages. It’s accurate and complete, and on the morning a maintainer deletes a package it tells you almost nothing. You can see that tiny-util sits three levels down. You can’t see whether losing it breaks the checkout page or a script nobody has run since spring.

A dependency tree answers “what do I depend on”. The question that matters is “what breaks, and for whom, if this package vanishes or turns hostile”. They need different data. The tree comes from a lockfile. The answer comes from your own source: which functions call the package, which routes, commands and jobs those functions serve, and how much code would change to replace it. A tool that produced that for every package would turn dependency management from an inventory into something a product owner can read.

A coding agent spends its day reading text written by strangers: issues on your issue tracker, snippets pasted into prompts, code from repositories, instructions on web pages. One malicious instruction planted in that text can be enough to make an agent send a deploy token somewhere it shouldn’t. On a machine-wide VPN, that request leaves the same way as everything else, and afterwards nobody can say which program sent it.

Mobile security vulnerabilities cluster in a predictable set of categories. The same mistakes appear in security audits of consumer apps, enterprise apps, and fintech apps with equal regularity. The recurrence of the same errors across different teams and different organizations suggests that the failures are not primarily due to ignorance — most mobile developers are aware that security matters — but to a gap between security knowledge and the specific engineering practices that translate that knowledge into secure code.