question on SAST/code scanning and security PR triage

[bmccall17]

hi, we've been researching application and repo health across the open source ecosystem, building a tool called repOptics to understand patterns across projects. ran a scan on vue and one thing that stood out was the security category scoring 54/100, driven mainly by the absence of a SAST workflow. noticed there are also a couple of security-tagged PRs that have been open 30-55 days without human review. curious how the vue community thinks about automated code scanning and security PR triage. is there a process for this that lives outside the main repo, or is it something that just hasn't been prioritized?