> We think the issue might not be severe enough [...] It might not? In other words, if a security vulnerability is reported, assume everything is actually fine

> We think the issue might not be severe enough [...] It might not? In other words, if a security vulnerability is reported, assume everything is actually fine until proven exploitable beyond any shadow of a doubt?