@Gnuxie Where did anything say I didn't reply to that?
I did, in fact, reply to that.
Their email also said, "there’s no practical security impact on Matrix."
From the timeline:
2026-02-17: Matrix.org Security replies insisting, “there’s no practical security impact on Matrix”
2026-02-17: I respond to Matrix.org with an additional PoC, a patch, and express disagreement with their reasoning
Instead of querying me with "Why didn't you X?" maybe read the actual thing I wrote where I said that I, in fact, did do X.