Do you think this is fair?
"Problems that only trigger using legacy dependencies are not considered security problems."
@bagder I can't parse the sentence. Does the problem trigger the use of the dependency, or vice versa?
@nemobis if there is a problem in curl, but it needs this legacy dependency to trigger