Cooldowns don't apply when you're patching a CVE; like, dependabot vulnerability scanning in GitHub has a separate cooldown from auto-updates