We got owned by Snyk on our own product. Last week Snyk flagged a real transitive vulnerability in our production repo ([email protected] via resend). We were only reading package.json - like most lightweight scanners still do — while the actual attack surface lives in package-lock.json.

So we did what we always do: we fixed it.