I used to develop custom Node+React web apps for an org that required security audits. I was happy to get my code audited for vulnerabilities, but when the aud

I used to develop custom Node+React web apps for an org that required security audits. I was happy to get my code audited for vulnerabilities, but when the audit came it was just a bunch of boxes ticked for Drupal/WordPress/etc. vulns.