Just migrated our internal Jira plugin to use the new APIs. The platform's built-in "security audit" feature scanned it and gave it a clean bill of health.
But it completely missed that the plugin was pulling in an old, vulnerable version of `org.yaml:snakeyaml` (CVE-2022-1471). The dependency was buried three levels deep in a transitive chain from a popular utility library.
The audit only checked direct dependencies declared in the plugin's main `pom.xml`. It didn't traverse the full tree or flag known vulnerable artifacts deeper in the graph.
I only caught it because our GitLab CI pipeline runs a separate OSS scan on the final assembled artifact. The "security audit" inside the dev platform gave me a false sense of security. Has anyone else run into this? It feels like a pretty basic miss for a feature with that name.