Not always, it can be run at static code analysis or the container repository (not the prod one)?