2 engineers at a 4 person startup; we have a list of licenses, the lawyers and auditors told us which licenses are allowed but then we rely on the community to

2 engineers at a 4 person startup; we have a list of licenses, the lawyers and auditors told us which licenses are allowed but then we rely on the community to police itself for vulnerabilities. I would find myself frustrated by any process involving a security team review; the savings are enormous and the scary parts of this problem haven't manifested nearly enough to justify the additional overhead involved.