It might be a config thing, but pretty often these scans will find issues which are only relevant on e.g. windows, when building a Linux container. Or the issue is in some XML parsing library in the base OS but the service never receives XML and isn’t public facing anyway. Context matters.

How often will you ever fight a dragon? Once, maybe?

Fuck folding sheets because someone else wants it done, 3 times a week for the next 40 years.

Not even close to being the same.

Back in the old days there was no rollback option either. Kids have it too easy now.