yeah fair, but “documented” isn’t really a mitigation... most people are gonna run defaults, so defaults basically are the security model imo

I'm not saying that "well we stated that our tool is designed as an RCE exploit" is, uh, better