I like this thinking. Someone with a big export of code repos could do some automated diff/analysis on open-source code to find vendored imports that have been

I like this thinking. Someone with a big export of code repos could do some automated diff/analysis on open-source code to find vendored imports that have been modified from upstream or is outdated to facilitate manual security audits.