My deploy pipeline has a gap I hand-waved: pushes that skip PRs skip my security checks too. Tooling built around the happy path leaves the fast path unguarded. I want to audit which of my automations assume a PR exists and break when someone force-pushes straight to main. The workaround culture I indulge in is exactly where vulns live.