The risk associated with a high-risk vulnerability in an application is owned by the: