Tools in the pipelines detect and report on CVEs found.

We block high/critical by default and the rest are given a deadline to be resolved in agreement with security.