# A production overlay lists a remote base with ?ref=main. What's the risk?

Kustomize, Hard (Expert), Security. https://k8wiz.com/uquiz/a-production-overlay-lists-a-remote-base-with-refmain-whats-the-risk

- A. Kustomize caches main on the first build and never sees any later updates to it
- B. Remote bases can't use branch names, so the build fails
- C. kubectl apply -k skips remote resources without warning
- D. The build changes whenever main changes, even if your own repository doesn't

**Answer:** The build changes whenever main changes, even if your own repository doesn't

**Explanation:** Kustomize fetches the remote repository at the given ref on every build. A branch moves, so two builds of the same commit can produce different YAML. Pin ref to a tag or, better, a commit SHA, and update it on purpose.