Secure open source consumption requires more than an approved package registry or a scan before release. Teams need to control where components come from, evaluate them when they are selected, choose suitable versions, and keep track of the m as new risks emerge .