Question about handling security issues directly in PRs

Quick question — In your experience, how do teams usually handle security issues (like SQL injection) once they’re detected? From what I’ve seen, most setups stop at detection, and developers still have to manually fix everything. I recently tested a workflow that automatically comments suggested fixes directly inside pull requests, and I’m trying to understand if this actually aligns with how teams using Nango work. Curious how you approach this today.