A Product Owner asks whether an item that is code complete but not yet security reviewed can be shown at the Sprint Review, given that the Definition of Done includes a security review. What is the correct position?

• AIt may be shown as long as the remaining work is disclosed to stakeholders.
• BIt is not Done, so it cannot be released or presented at the Sprint Review, and it returns to the Product Backlog for future consideration.
• CThe Product Owner may waive the Definition of Done for a single item if the value is high enough.
• DIt counts as Done because the Definition of Done is a guideline rather than a rule.