For @WalletScrutiny I'm thinking about this a lot, together with Project Loupe, too. The problem I see is "responsible disclosure". You will always find something and even the stuff you might want to responsibly disclose at first sight might not be an issue after all, so what will you signal and when and to whom? I'd happily show what people signal on WalletScrutiny. Make clear attestations. Known pubkey attests that commit X of project Y was checked with prompt Z on model A with these results ... Highest criticality found: B Let's agree on a nostr event format. We might not engage in producing those events as "WalletScrutiny" but with clear attribution to nostr accounts I see no problem showing them.