Comment by chris_wot

So tl;dr - fixing a security bug is rarely the end of the story, fixing the root cause is far more important. And don’t piss off the users.