How do I get details of a veracode vulnerability report?

I'm a maintainer of a popular JS library, Ramda, and we've recently received a report that the library is subject to a prototype pollution vulnerability. This has been tracked back to a veracode report that says:

ramda is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the _curry2 function and modify attributes such as __proto__, constructor, and prototype.

I understand what they're talking about for Prototype Pollution. A good explanation is at snyk's writeup for lodash.merge. Ramda's design is different, and the obvious analogous Ramda code is not subject to this sort of vulnerability. That does not mean that no part of Ramda is subject to it. But the report contains no details, no code snippet, and no means to challenge their findings.

The details of their description are clearly wrong. _curry2 could not possibly be subject to this problem. But as that function is used as a wrapper to many other functions, it's possible that there is a real vulnerability hidden by the reporter's misunderstanding.

Is there a way to get details of this error report? A snippet of code that demonstrates the problem? Anything? I have filled out their contact form. An answer may still be coming, as it was only 24 hours ago, but I'm not holding my breath -- it seems to be mostly a sales form. All the searching I've done leads to information about how to use their security tool and pretty much nothing about how their custom reports are created. And I can't find this in CVE databases.