“Then the final phase is what we call delivery, and that's putting stuff into a vulnerability repository like DefectDojo and then pushing out metrics and reports and bugs into bug trackers.”

Transcript evidence from Matt Tesauro -- #AppSec Pipeline as Toolbox.