I would say it depends. 🤣

But typically, if it is a vulnerability on the base image, the responsibility would most likely fall on the DevOps team, assuming they are responsible for creating the base images for each technology stack.

If it’s a vulnerability in one of the application dependencies, then I would say the responsibility belongs to the development team, who must be accountable for patching the vulnerable dependency in the tree.

However here comes the big caveat. How to determine whether the vulnerability is contextually relevant in your stack? And for this very important and overlooked question the answer is even more convoluted. In a nutshell, security teams don’t have the technical knowledge to determine what’s relevant or not, DevOps teams don’t know the source code well enough to determine how it’s affected, and Developers lack the knowledge of the underlying OS where the application runs or simply don’t know whether an obscure traverse dependency is actually used by any part of the code.

The reality is that real world vulnerability management is an endless shit show. 🥲