[inigyou]

If the customer can run the scanner and find the vuln, that means they can log in, right? Which means they can RCE.

[pylua]

Not always, it can be run at static code analysis or the container repository (not the prod one)?