> effectively pushing the responsibility back onto the clients of the library. That does not compute. The responsibility is pushed back onto the security resea

> effectively pushing the responsibility back onto the clients of the library. That does not compute. The responsibility is pushed back onto the security researcher to prove that there is an actual vulnerability in practice. Libraries (ideally) have documentation and contracts on what they expect on their input. If clients don't abide to the contract then it's on them. If the library has a wide contract then it's on the library. However even if the library has a bug, the bug needs to be exercised by clients for it to be an actually impactful vulnerability.