I have a much bigger problem with your post than his--and calling him out for a &quot;terrible attitude&quot; regarding security is a little bit funny seeing as he runs Gauntlet.io, which while not my favorite scanner out there is a legit tool that deserves more respect than you have afforded him. He has his bona fides; where are yours?<p>And, more concretely, I have no problem with his pointing out that some of--not all, but some--these issues are ones mitigated by decent, security-aware software development practices, like, oh, &quot;don&#x27;t spit something into a template out of your input parameters&quot;. Because tools break. Your libraries break. They will always break. Program defensively in all situations where hostile input is possible and never take for granted any attempts to defuse attacks; always favor braces-and-belt wherever possible and you&#x27;ll generally do okay. It&#x27;s entirely unnecessary to be a jerk towards him for saying this.