Agree that people like to fluff the severity of bugs they report. It's better for prestige and bounty payouts. But this is a little more nuanced.

"While I didn't really intend the module to be used for any security related checks, I'm very curious how an untrusted input could end up being passed into ip.isPrivate or ip.isPublic [functions] and then used for verifying where the network connection came from."

It's interesting, that it would be hard to make a case that there was a "vulnerability" in the ip package. But it seems like this package's entire purpose is input validation so it's kind of weird the dev thinks otherwise.

Recurring incidents like these raise the question, how does one strike a balance? Relentlessly reporting theoretical vulnerabilities can leave open-source developers, many of who are volunteers, exhausted from triaging noise.

The researchers need to provide proofs of concept. Actual functional exploits.