Dear god. Just, look at this one report [1] - it's worthless LLM slop iterating on top of more worthless LLM slop, but the initial report is just plausible enough to waste a huge amount of time and energy to investigate and respond. Personally, I would try to run as far away as possible to avoid having to deal with this bullshit. Sternberg has the patience of a saint.
[1] https://hackerone.com/reports/2298307