These bullshit “security scans” are disruptive and barely more than box checking exercises by alleged “cyber security” people.

I’ve seen entire companies cripple themselves with this security theatre for days on end requiring usually some executive interjection to break the deadlock.

Instead of applying nuance, it’s all black and white. I once experienced at a job not being able to deploy urgent hot fixes even for live production issues impacting customers.

Reason? The useless DevOps team introduced some automated security scanner which found a single reported vulnerability in a development tool. A tool that in no way reaches the users browser or the servers.

Bear in mind this was a brand new found vulnerability and there was no fix yet.

But because of that, and because of their lack of understanding, and their insistence we were just being stubborn and not believing us when we told them there is literally no fix available yet, they disabled our ability to deploy anything.

While the urgent fix for production was already committed and merged ready to be deployed.

It took great managerial pomp and fanfare to get that abolished.

I’d imagine there’s a great deal of pressure on OSS maintainers when these borderline CVEs get published.