CI pipelines are worse than that. When a CI pipeline flags a vuln in a dependency it typically goes to the dev couched as a "defect" they need to remedy as part

CI pipelines are worse than that. When a CI pipeline flags a vuln in a dependency it typically goes to the dev couched as a "defect" they need to remedy as part of their unrelated PR. Left entirely out of the consciousness horizon is the realization that the code is almost certainly <<running in production right now>>. Where is the check that it hasn't been exploited, or concerning what the attack surface is in the product (or even if continuing to embrace the dependency is worth the hassle)? Where is SecOps?