Yup thanks this is probably more sensible than returning the count.. One can count the advisories in the json output if they care about the count :)

Thank you!

Regarding the STATUS_ prefix in the constants, please, be aware that I decided not to use the "status" term in order to avoid confusions, as these values are not always what the user receives.
My reasoning was that they are the basis of the final result, but not an exact representation of it.

Yeah fair enough but BIT_ sounds like leaking an implementation detail in the name to me.. I guess both have some flaws :D But I don't really expect many will rely on these constants as this is usually called via CLI, so no biggie either way.