As someone who helps teams with security, please don't take dependencies that haven't been reviewed. If you speed is more critical for you, do not expect your software to be secure and __ALWAYS__ have a incident response plan. It should have a way of informing dev teams, management & customers about what happened, what is being done and how soon.