The adage that security companies are often worse at software security than the median non-security company continues to hold water.

Last month it was trivy: https://github.com/aquasecurity/trivy/security/advisories/GH...