would you prefer an open issue or a reply on here for the security review?