Technical Infosec guys can fix vulnerable dependencies themselves and use the tests Bob writes (right?) to make sure they don&#x27;t break anything.   Only need to bug Bob when there is a breaking change and you prioritize it with Bobs PM.<p>Also passwords are dumb - Bob should use certs and or ssh keys and 2fa to access anything.<p>The point is that any security that hinges on hassling Bob is likely bad security.