Hacker News Reader

Completely agree. I get a lot of "CVEs" that are "test code has a hardcoded key" or similar. Once or twice a year I get a real CVE.

"Urgent critical vulnerability: SPF record on your domain allows soft-fail, do the needful and pay a bounty for our hard work"

"Critical: your Google Maps API key is visible in your web page as required."