I support your decision.

If Mathy was concerned, why did he wait to notify CERT? Should that not have been the first priority?