Vendor risk management in a Git-driven workflow means knowing exactly what code you pull in, where it comes from, and how to isolate it. Git makes this possible, but only if you apply the right branch structure, tagging, and review process. Without it, external libraries or modules can introduce vulnerabilities,