If it's a PR created by just prompting with the vuln report, I might as well do it myself.