[red-iron-pine]

the point of it is that I don't have to check. otherwise now i've just added an extra set of typing and validation.

plus, now i've been biased by the immediate response. if it says "these CVEs don't have vulnerabilities" then I'm now thinking they're probably okay and just need to validate, instead of starting from zero and doing due diligence. this will lead to confirmation biases or laziness.