6.3 Rug Pull Protection

Description

Remote components MUST be pinned to specific versions or hashes.

Rationale

A 'rug pull' occurs when a trusted component is suddenly replaced with malicious code.

Audit Procedure

1. Check if all dependencies are pinned
2. Verify MCP servers reference specific versions
3. Check for auto-update settings

Remediation

1. Pin all dependencies to exact versions
2. Use lockfiles and commit them
3. Monitor for component changes

Framework Mappings