as a maintainer when you ignore a security audit as irrelevant (whether that original report has merit or not), you’re playing a part in watering down the entire system to mean *nothing*

obviously, something needs to change here