Ran npm audit on a fresh create-react-app. Got 87 vulnerabilities. 12 critical. Filed a ticket. Manager asked me to close it because it was 'slowing down velocity.' That was 8 months ago. The vulnerabilities are still there. We shipped to 300,000 users.