“Sure, but this vulnerability also affects servers outside the scope of the audit, it doesn't count.”