Based on the security incidents in which application security was invaded in recent years, this paper explores the potential threats to today's application system security and supply chain vulnarability. In addition to the currently well-known security threats, this session specifically explores threats that may not be considered in "application security testing" and "software supply chain security". We will also discuss the technical and management process aspects, and how to complete necessary security checks in S-SDLC and automated CI/CD processes. And add these TTP into your Threat Modeling knowledge.