I hook mine up to some classical static analysys tools like sonar or codacy. Just ask it to remove the security findings and haven’t had an issue. Then again, been on vacation while all this shit has happened, so don’t know what to expect when I return.