I fail to see how a bug in a development branch that nobody should be using in production is worth discussing, from a security incident perspective. Perhaps way

I fail to see how a bug in a development branch that nobody should be using in production is worth discussing, from a security incident perspective. Perhaps ways of catching that category of bug in an automated way would be an interesting topic.