Why Most Lodash Vulnerability Reports Get Rejected

Around 95% of the security reports Lodash receives get rejected, even when the proof of concept runs. Here is how the threat model decides where a library bug ends and an application bug begins, the patterns we keep closing, and the one question to ask before you file.