Elastic interview question

Open Source vulnerability - how do you defend?