i didn't say doing AI reviews of the projects makes sense, what I question is the need to spend all the effort in announcing the great successes of the beloved red team not to mention the incredibly sloppy instances of public msgs across platforms tagging founders/maintainers saying "hey read your DMs we need to discuss something security related". doing the work and making sure everyone knows you are doing the work are two different things. incentives and expected value calculations are a bit different when you as an attacker need to guess/hope that some of the projects will bare fruit of your attacks vs having confirmation that theres tons of vulns so just dig and you'll find more gold. specially because theres no value in spreading the stats of the results besides telling everyone how great of a job you are doing.