Comment by digdigdag

> We didn't review the entire source code

Then it's not fully investigated. That should put any assessments to rest.