Sometimes, the pipeline for the default branch will not run
security-related jobs. When that happens all vulnerabilities would be
marked as fixed on the default branch where it would not be the case.