ZCode data leak, OpenAI breach, and Korea fines highlight single-dependency risks

Three cybersecurity incidents surfaced this week, illustrating the dangers of over-trusting a single tool or vendor. Coding agent ZCode was found silently uploading users' Git histories to the cloud, while researchers exploited a heap overflow and an SSO misconfiguration to access OpenAI's internal repositories. South Korea also announced it would raise data-breach fines to 10% of company revenue, making compliance failures potentially business-ending. Security experts warn that most small businesses and SaaS operators unknowingly rely on undermaintained plugins, unvetted APIs, or third-party tools with broad access to sensitive data. The recommended response is not adding more security tools, but auditing every external dependency by its access level and preparing contingency plans for when key services fail or are compromised.