[Boost-users] Dealing with resistance to Boost

I am trying to get my organisation to use Boost. I have managed to get it included in source control and we have permission to use it in our unit testing. The main objection to using it in our production code is that it could be a potential security risk. I suggested that we restrict the usage of boost to the template\ headers only libraries. I don't see how the templates in boost can cause more of a security risk than what we have currently with the STL. My question is: How is vulnerabilities in the library dealt with? How is new vulnerabilities communicated to the user's community? I would also like to know historically, how many and how often were vulnerabilities discovered? Any good references would be great. Thanks,