A usable feature passes its individual acceptance criteria but lacks the security checks required by the team's Definition of Done. How should it be treated?

1. It can be counted as Done if security work is hidden in another item
2. It is not Done until the Definition of Done is satisfied
3. It is Done because acceptance criteria replace all quality standards
4. It is Done if most Developers approve a waiver informally