Yeah. A git bisect can still hit it.

It definitely doesn't inspire confidence in the project taking security seriously.

(Also the "write-up" is almost surely a "Claude-up", though it appears generated by someone external to the project).

They still have the opportunity to remove it I guess?