Software supply chain security for Cloud Apps