I think I would argue that linking to the security problem(s) and then writing about their style and how they probably came to be counts as discussion, but to each their own.