It's done by another team. It's use is generally comparable to NPM and pip. In fact we use pip, but we pull from our servers instead of public. A lot of the

It's done by another team. It's use is generally comparable to NPM and pip. In fact we use pip, but we pull from our servers instead of public. A lot of the scanning is automated and takes care of problems I've actually run into, like virus laden files. if something is not available, we don't use it. Because the cost of violating that policy is worse than having to find another solution.