isaacs: not to report a vulnerability