Blame me for this 
I found the security issue with Custom and even got paid for it. Can’t disclose much more other than there was an attack vector and the only solution was to introduce manual checks.
Fun fact, I then fell victim to this scrutiny myself. Wanted to use custom multiple times, sometimes got denied