That's pretty much the story. It came in as a high priority issue with no context. I asked for clarification, he asked if we wanted to fail the the audit. I changed them to red and he wrote a thing about we were more secure now.