Quite right. But as I said, "intercepting another user's traffic" would be an additional vulnerability, but not if you're on VPN. Maybe you could just admit th

Quite right. But as I said, "intercepting another user's traffic" would be an additional vulnerability, but not if you're on VPN. Maybe you could just admit that and end the argument. This doesn't require you to minimize the seriousness of the bug.