[hajrice]

I imagine a cool way to get users to notice your tool would be to scan public Github repos with many followers, and comment on the code vulnerabilities.

[jjjutla]

Yes, that's exactly what we do. Some examples: https://github.com/eosphoros-ai/DB-GPT/pull/2650, https://github.com/dagster-io/dagster/pull/30002

We just need to follow responsible disclosure first by notifying the maintainers, working with them on a fix, and making it public once it is resolved.