> One compromise was due to a vulnerability that was already fixed, but had persisted on an old branch. Any time we make a security improvement (including patch

> One compromise was due to a vulnerability that was already fixed, but had persisted on an old branch. Any time we make a security improvement (including patching a vulnerable Action) on a GitHub Actions workflow, we need to remember to cherry-pick it to all branches, including stale ones. This stands out as an easy mistake to make.