Does the security team not count as one of the sets of "eyes"? Would they have discovered the bug without inspecting the code?