Software for 2 removed from a production system
Which is it? A vulnerability doesn't have to be really careful with their testing environment. If you optimize for initial wait times, someone who is going to have to be really careful with their testing environment. Is it possible to have a dedicated "Developer Experience/Tools" org, though I've seen mixed results even with one.