Fair enough, which is why I called out my assumption:). I'm referring to the all hands on deck nature of responding to security issues not the best practice. F

Fair enough, which is why I called out my assumption:). I'm referring to the all hands on deck nature of responding to security issues not the best practice. For many, the NPM issue was an all hands on deck.