Can You Trust Your Build Cache?

Shared remote build caches are trust boundaries that most teams never audit. When a task's cache key doesn't include all files the build actually reads, an attacker on any branch can poison the cache by editing an undeclared file, seeding a malicious artifact under a clean hash, and causing everyone on main to replay it without ever seeing the payload. Real open-source monorepos were confirmed vulnerable. Mitigations include disabling cache reads for release/publish jobs, separating cache write access by branch trust level, treating cache tokens as sensitive credentials, and auditing undeclared inputs like shared tsconfig files. Nx Cloud's recommended access control and Task Sandboxing (strict mode) enforce these controls automatically by scoping writes by branch and validating file I/O against declared inputs at runtime.