Comment good (Score 1) 65
Good on them for taking the security threat seriously. IMO every project owner should be doing regular "bug finding missions" using the best AI tools available on a regular cadence and/or as a part of their testing process. It's a dereliction of duty if you aren't. That goes double (or triple) for OSS projects, where the bad guys have roughly the same tools available to them and where you can be sure they're using them to find flaws.