One thing I should've expected in those reports but didn't is that some maintainers end up nitpicking the reports instead of just doing the best to address the issues. When discussing the LLM code reviews, one author was arguing the security reports are really bad - it turned out that I completely disagree on the judgement they made. Instead of accepting that something can be improved, they argued how unlikely something is, how the project doesn't make this kind of guarantee, how that's an API user error... instead of saying:

- Yeah, we could check the parameter here. Currently we don't return any result so let's add a success/failure response rather than silently failing.

- This is a highly unlikely situation, but let's harden it anyway in case things change and it bites us in the future.

I don't know how many end up in that situation, but it was a whole category of people claiming the LLM reviews are bad, that I haven't really considered before.