The dev that has never shipped a bug must file the first cve