After 1.5 years, finally got a vulnerability report through to the devs. Well done Atlassian 🥹