[mmorse]

Correct, they're private for safety. Sometimes it's prudent to cloak the whole bug rather than remembering to do it on individual comments - just mentioned above and in the release notes to point out that vulnerability has been addressed.