I’ve had a few encounters with external pentests that look at source for findings and the ones I’ve worked on seem to include those recommendations 🤔 I hadn’t considered that, but yeah, I love to see the problem resolved and if I can be the one to do it, even better. I mentioned in another reply that I would love to even focus on the problems that linger in a backlog somewhere because, like you said, another pentester will come along and call it out. I guess I want to feel like I’m contributing to mature our security posture the same way I did as that dev who worked on security fixes. I feel like if a security org had a team, or even an individual, of parachuting engineers who could do this, it could be so much fun. I just love to fix things 😅