If the build script can execute arbitrary processes, the entire security is lost.