Elastic Interview Question

Open Source vulnerability - how do you defend?