> ... instead I will ask how they produce builds, what the deploy pipeline is, and then track back if I find their answers alarming.

That's a good approach, noted!