Ha ha. The part that isn't being discussed how it is more profitable for certain commercial interests to have more vulnerabilities even if they are bogus.

There is something wrong with security industry and we are all paying the price. At my day job some tool automatically opens security bugs against 15 or so repos we maintain and now we are on the hook for arguing how the report was bogus or fix the vulnerability. Just PR and Jira dance one has to do is exhausting.

The recommendation of "blocking builds/deploys that contain high CVEs" is nonsense. It should be conditional on not having exactly the same CVE in what is already deployed, as it is blocking unrelated fixes.