Well ideally you get in early and catch it in a mandatory PR process, all PR's pass through EU devs who are the only ones who can merge. Otherwise yes, securit

Well ideally you get in early and catch it in a mandatory PR process, all PR's pass through EU devs who are the only ones who can merge. Otherwise yes, security certification process to review existing code and then maintain as above.