So, don't add dependencies before you audit the code? That seems like a pretty reasonable ask to me.