[pseudohadamard]

Had a similar experience with an open-source project I help maintain, AI slop bug report saying "your code is vulnerable to blah, you should be doing one of a, b, or c to mitigate it". The mitigations a, b, and c were taken directly from the code the slop report was commenting on, where they were present and already being applied.