Second “disclosure” I get in a month about my OSS which essentially is “if you disable authentication, ignore the docs and you have a malware on your computer, the tool can be used for privesc”. And of course, when asked what would be the fix for that you get this face …