This was my thought. A popular open source project will get a lot of wannabes who just want their name on something and file issues from random code analyzers,

This was my thought. A popular open source project will get a lot of wannabes who just want their name on something and file issues from random code analyzers, etc. I've looked at CVEs that don't have a good solution and decided to release because I understood the attack vector and it didn't apply to how we used the library. That's not the same thing. That said - the problems being discussed here do happen, I just don't know how accurately the headline represents that.