The tradeoff is that you become your own ops team and need to monitor and respond to cves in real time.

I was also referencing that using commercial software usually brings features you probably don’t use. Those features probably require new NPM packages so by building a bespoke software, you only build features you need.

this is often a worse time-to-patch