I quit a gig recently because the CI/CD pipeline had automatic scanning of dependencies for vulns (yay!) and no tangible process for dealing with them. It was

I quit a gig recently because the CI/CD pipeline had automatic scanning of dependencies for vulns (yay!) and no tangible process for dealing with them. It was up to the dev to "fix" this "defect" before code could be merged. There was no pinning policy. There was no actual security review (where do we use this? are we vulnerable? why do we use this? are there alternatives?). Meanwhile it's running in production. (have we discussed this with our MSP? can I discuss this with our MSP? has our MSP notified us of any issues?) Although we say ignorance is no excuse, having spent a decade in cybersecurity and 20 years before that as a quality-focused consultant, I'd say ignorance lets people get away with a lot. But I know better and I would never be allowed to claim "I vass only followeeeng zee orders!" if the shit hit the fan.