# Development Dependencies Shipped to Production Are Exploit Primitives ## Claim The security cost of an unpruned vendor directory is not bloat. Every class that is autoloadable in production enlarges the gadget-chain surface available to an attacker who achieves object injection, so a build flag becomes a security control and a bill of materials becomes a security artifact rather than a compliance one. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Applies to any runtime with deserialization and autoloading — PHP most acutely, but the reasoning holds wherever loaded classes are reachable primitives. Assumes an injection point exists; without one the surface is inert. ## Links - [[Exfiltration Needs Three Capabilities Together Not Any One of Them]] — evidence-for; the gadget chain is one of three necessary conjuncts, and pruning it breaks the chain - [[A Single Discretionary Update Channel Is a Security Dependency]] — extends; both locate risk in what the supply chain quietly includes - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — the architectural gap the MOC names, located in the build step rather than the host