imagine being a maintainer and having to write "this code does not exist" in a CVE response