If you're going to roll your libs, be sure to set up agents to scan for CVE analogues of equivalent known vulnerabilities in your own code. It takes quite a bit of work to set this pipeline up, as well as manually selecting high-impact CVEs (relying on the public scores is worthless, because there are some vulns that are catastrophic with a score of 6 vs something meaningless thats a 10).

It's also crucial to scan for "analogues" because otherwise many LLMs autoreport as "not vulnerable" since "this applies to Postgres/whatever and this repo isn't using it"

If you get hit by cyber guardrails you should use a local model to prune any CVE specific language from the reports.

To give examples, every single LLM (and people too tbh) will write netcode that's vulnerable to these CVEs: CVE-2026-27135, CVE-2024-45311, CVE-2021-32567, CVE-2019-9511; without explicitly mentioning the CVE text no LLM finds these either.