Thanks. Regarding cost... someone should sell curated security feeds to startups. There must be many dozens of engineers who monitor mailing lists for issues i

Thanks. Regarding cost... someone should sell curated security feeds to startups. There must be many dozens of engineers who monitor mailing lists for issues in (let's say) ElasticSearch. They could be incentivized to share their findings. Then if one source tags a certain CVE as significant, I get a ping. If several sources tag it, the ping gets more urgent. Eventually I feel scared enough that I upgrade.