Removed the flag that disabled vulnerability checks for non‑vulnerable refs; allow default security behavior.