A GopherCon 2025 talk examining the security gap between reviewed source code and compiled build artifacts. The speaker walks through real supply chain attacks including the BoltDB-Go malicious package on the Go module proxy, the npm event-stream incident, the TJ-actions GitHub Actions compromise, and the XZ Utils backdoor. A key insight is that attackers exploit git tag mutability and version discrepancies to hide malicious payloads from human reviewers. The talk introduces Capslock, an open-source capability analysis tool that analyzes Go build artifacts using call graph analysis (SSA/VTA algorithms) to detect unexpected capability changes in dependencies — analogous to mobile app permissions. Only 3% of Go package updates add new capabilities, making such changes a high-signal trigger for review. Capslock is now also in pilot for Rust. Recommendations include pinning dependencies by commit hash rather than mutable tags and supplementing code review with build artifact analysis.