…and really it shouldn’t be; security vulns should be reported privately, directly to iX.
There was another thread posted about it, just an hour or so ago, but I don’t see it now–perhaps it’s been deleted for that reason. (Edit: no it wasn’t; I just overlooked it: Has the recently found copy.fail exploit been addressed in Truenas?)
And yes, I know the vuln is pretty public at this point, so this caution might be moot–but it’s still good practice.