The malicious code could use life-before-main hacks to gain code execution if it's linked at all, even if uncalled.
https://grack.com/blog/2026/06/11/life-before-main/
replyIt doesn’t take away from the point that build time often has access to secrets the runtime does not.
reply