> You can't fix all of the bugs, nor should you try. You have balance bug fixing with feature development. Using that to justify not fixing specific critical b

> You can't fix all of the bugs, nor should you try. You have balance bug fixing with feature development. Using that to justify not fixing specific critical bugs is silly. A person reporting a CVE that allows arbitrary code execution is not saying "you should fix all the bugs", they're saying "This bug is important". You can and should strive to fix all clearly-reported show-stopper security bugs. Which this is.