Seán C McCord - Codeberg.org

The usual pattern here would be to return a pointer to a VulnerabilityReport. There are several reasons for this, beyond simply convention. One is that we avoid making an unnecessary copy of the data. Two is that we avoid all the unnecessary instantiations we see below, when we want to just return an empty report: we just return a nil instead, making the code simpler and avoiding an unnecessary allocation along the way.