Vulnerability scanning for PowerBI visuals

Visuals are certified as of when they were submitted and reviewed. Nothing changes from the published visual side of things if something changes with the rules or vulnerabilities get discovered in npm packages. Provided that npm returns no warning about vulnerabilities in any required packages, this is regarded as OK. Certified visuals are not removed if certification rules change retrospectively or package vulnerabilities are discovered.

However, if I, as a visual author, want to submit an update to my visual, I have to address the rule changes and ensure my libraries are patched accordingly. It's routine for any author who updates their visuals regularly, as certification will fail for the update (and the last reviewed version remains in AppSource in perpetuity until the author submits a compliant update).

I've never personally been contacted about package vulnerabilities in one of my published visuals, so I can assume that either (a) this doesn't happen or (b) I haven't been subjected to a significant enough incident to be contacted.