Hi Jonathan That's a perfect approach and reply suggestion, go for it! I wonder too sometimes if this is a tactic in order for a lazy researcher to try to gain a reproducer.
(I wouldn't worry about cc'ing in private@tomee though, you probably don't want to get that list too polluted, dev/user list is fine for followups). Regards, Mark J Cox ASF Security
