If this model is not willing to fix security issues in your application, does it mean that it's implicitly embedding vulnerabilities as well? How can it be trusted to write secure code?