via @bearstech
+ https://socket.dev/blog/curl-project-and-go-security-teams-reject-cvss-as-broken