Yea… pipeline and dependency auditing isn’t trivial if you want to catch the subtle stuff. Even most of the devs that know how to do it are going to respond with, “above my pay grade…” unless they’re somehow actually getting paid enough to be arsed to do it correctly…