it is too noisy, we just run a custom pipeline which scans with osv-scanner/trivy for critical