I am concerned it took over 2 weeks to start triaging a security bug along the lines of "auth can be bypassed"