PS Product SecurityKnowledge Base

📦 Marketplace, Actions, Images, Helm, and Public Component Review

Intro: The core review question is simple: what does this component get to read, write, or execute once we adopt it?

What this page includes

  • how to review public actions, container images, Helm charts, and shared components
  • supply-chain questions that matter to engineers
  • what to pin, mirror, or vendor
  • what to log and monitor after adoption

Review checklist

  • Who maintains it, and is that ownership credible?
  • Is the version pinned or floating?
  • Does it execute arbitrary scripts, network calls, or package installs?
  • What secrets, tokens, or mounted volumes will it see?
  • Can it change deployment outputs or only analyze inputs?

Safer defaults

  • pin versions or digests;
  • prefer reviewed internal mirrors for high-value dependencies;
  • separate read-only review jobs from deploy-capable jobs;
  • keep untrusted public components away from the highest-privilege runners.

Helm and image specifics

Review charts for privileged pods, host mounts, service account assumptions, ingress defaults, and hidden sidecars. Review images for update cadence, provenance, root behavior, package sprawl, and default entrypoint behavior.

Author attribution: Ivan Piskunov, 2026 - Educational and defensive-engineering use.