The security regression script uses grep everywhere else, and CI installs
neither ripgrep nor a shell that provides it, so an rg call would abort
make check under set -euo pipefail.