[patmorgan23]

There are "security researchers" who grep GitHub for the words 'password' or 'secret' and blindly file CVE's if they find any hits.

[stonogo]

and those CVEs are rejected or revoked. There are bad actors everywhere; they're not a good excuse to stop trying.

[worthless-trash]

There are -many- software vendors and developers that wont accept or even respond to security researchers. You are absolutely correct.