If a developer refuses to fix a high-severity vulnerability because it will delay a product launch, how do you handle the situation at Moody's?
