Sorry for putting the security hat, but how does anyone run Deno in production without any worries when this is the state of affairs of their vulnerability noti

Sorry for putting the security hat, but how does anyone run Deno in production without any worries when this is the state of affairs of their vulnerability notifications and scanning. No SBOM / SCA tool that I know of supports deno.lock and since it has a distributed nature, as far as I understand there is basically no way to be alerted on CVEs, unless you work hard to generate a compatible package-lock.json / yarn.lock file and stay with only npm compatible packages etc. Is it bothering only me? https://www.reddit.com/r/Deno/comments/1g5mu0l/thats_all_good_but_whats_with_audit/ https://www.reddit.com/r/Deno/comments/1g5mu0l/thats_all_goo... https://www.reddit.com/r/Deno/comments/1dpexwv/dependency_vulnerability_notifications/ https://www.reddit.com/r/Deno/comments/1dpexwv/dependency_vu...