Could you explain what makes you think this is likely due to a vulnerability and not just a false positive?
Because this is not the first time that this was reported (See this thread).
I think the FAQ page is the official response to this, but you can wait for Damien’s response anyway.