Comment by andix

If they file a CVE, they will draw a lot of attention from experts to the project. Even from people who never heard from this package before.