> confirmed that they think it is a real security issue There is no definition or even industry consensus of what is a real security issue. Scoring systems are

> confirmed that they think it is a real security issue There is no definition or even industry consensus of what is a real security issue. Scoring systems are widely accepted as flawed. So in practice, this isn't how it works, as the article demonstrates.