Hacker News Reader

In my experience, most CVEs are reports about ice cream trucks lacking nuclear-proof bank vault doors.

Sure, but jq is very much a "front door" in your analogy. You'd have to look at each individual CVE to assess the risk for your specific case, but for jq, claimed security vulnerabilities are worth paying attention to.

> I don't want to devalue the CVE system

You could, though. It's 99.9% stuff like this!