>thinking that they are somehow helping

>Our worst nightmares are becoming true indeed

Agree completely with you, but most of the time this isn't people being altruistic.

It's people spraying bullshit at maintainers to try and score "CVE IDs as trophies" for their résumé or payouts from the vendor-backed Internet Bug Bounty (IBB) program on HackerOne.

https://hackerone.com/ibb

https://daniel.haxx.se/blog/2021/09/23/curl-joins-the-reborn...