It will probably be less effort to patch (increment version number) a non existing vulnerability than to explain it to every customer that comes with an report

It will probably be less effort to patch (increment version number) a non existing vulnerability than to explain it to every customer that comes with an report from a third party auditor. CVEs for non-vulnerabilities is like corporate trolling