[killion]

I like his point about `npm audit --production` being a good way to cut down the noise. But Github doesn't seem to take dev dependencies into account when sending security alerts. I get emails about non-issues from them all the time.