> no CVE list, no CVSS distribution, no severity bucket, no disclosure timeline, no vendor-confirmed-novel table, no false-positive rate Yeah, that's cooked data - it's too easy to ask the LLM to give you the CVE list, the CVSS distribution / severity buckets, timelines, everything you might want. I have LLMs doing pull request reviews and as a default response they just give potshots, but if you prompt them they will point directly to the files and line numbers where the problems they are pointing out reside...