Honestly, in the case of mongodb not using authentication I feel which it should be reported as report_note or even as report_vuln, thoughts?