They did not disclose security vulnerabilities. They took unfinished disabled testing code and called it a security vulnerability. Do you really need it unpac

They did not disclose security vulnerabilities. They took unfinished disabled testing code and called it a security vulnerability. Do you really need it unpacked and explained exactly how and why that is a monumentally stupid thing to do? Everything, from code to a chair to a sandwich, is unfit for purpose until it is finished. It serves no purpose to raise an alarm about that when it is a baseline that applies equally to everything in the world. If one person does it it's just stupid and annoying and not meaningful or useful. But if you didn't understand that and thought it was a logical thing to do, then everyone else should do the same. If everyone else did the same, this would mean that every single new commit to every single open source codebase would qualify exactly the same. That is not a useful thing to try to do. Eleventy seven gobqillion CVEs every hour for every project in existence. Great. Useful. OF COURSE the bathroom is not safe to use yet when the plumber has not yet told you it's done. This isn't a defective or unsafe bathroom, it's not yet declared to BE a bathroom at all in the first place yet. A pile of materials isn't an unsafe and defective bathroom, nor is a half-built bathroom, nor is a bathroom that is practically done and even the plumber thinks it might be done but is still just doing the final checks before signing off on it. No matter what state it's in, if the contractor has not yet signed off on it, then it's still the same as the pile of raw materials from the start of the job, and it's not useful to anyone to go on some world wide reporting site and warn everyone that this bathroom has leaks and electrical hazards. It's not just being safer than neccessary, it's not even merely illogical and stupid but harmless, it's actively counter-productive and harmful by diluting the meaning of all other actual CVEs.