Disclosed are various embodiments for using distributed ledgers to assist in securely developing applications. An application component comprising a component file can be received from a validation client. It can then be determined that the application component complies with a security policy. In response to a determination that the application component complies with the security policy, an endorsed application component record can be generated that comprises the component file or a network address at which the component file is obtainable and a signature for the component file generated with an asymmetric key-pair stored in the memory. The endorsed application component record can then be stored in the distributed ledger.