Wouldn’t most companies worth exploiting run some static analysis in the ci cd