[rifung]

> Also, this makes me wonder: does every project have at least one security engineer until it gets shut down?

Usually a specific project doesn't have dedicated security engineers but instead the engineers have to get approval from security engineers for their relevant designs.

This is probably different for teams dedicated to security like those that write fuzzers and the such.