One thing that really interests me is declining to issue CVEs. I get a lot of AI submitted security issues and they all want CVEs. But some are simple idor to access information around an age rating on selfhosted software for friends and family.

Does anyone have any advice when to decline CVEs?