> required. No user interaction. The vulnerable code was introduced in a 2015 commit and sat undiscovered for nearly 11 years.

I think about this quote a lot: given enough eyeballs, all bugs are shallow