The security questionaires we have to perform for our larger customers now include that we pin the exact hash of a container or mirror any image locally. This i

The security questionaires we have to perform for our larger customers now include that we pin the exact hash of a container or mirror any image locally. This is in addition to pinning versions of NPM packages and using our package lock for installation. We now have a basic rule that :latest doesn't make it past proof of concept stage. This has made automation of our package & container maintenance crucial, since we are a lean shop. It's pretty much a weekly occurrence that a low-medium vulnerability pops up somewhere once your application is large enough.