How Components Build Risk Into Apps