Comment by xena

As an SRE, if there's any possible ambiguity as to if an issue is a security issue, treat it as one until proven otherwise.