Technical Infosec guys can fix vulnerable dependencies themselves and use the tests Bob writes (right?) to make sure they don't break anything. Only need to b

Technical Infosec guys can fix vulnerable dependencies themselves and use the tests Bob writes (right?) to make sure they don't break anything. Only need to bug Bob when there is a breaking change and you prioritize it with Bobs PM. Also passwords are dumb - Bob should use certs and or ssh keys and 2fa to access anything. The point is that any security that hinges on hassling Bob is likely bad security.