Of course this is marketing, that is obvious from the title alone. The open source projects give them a means to post a high numbers of bugs found by their magi

Of course this is marketing, that is obvious from the title alone. The open source projects give them a means to post a high numbers of bugs found by their magical product. For a high number they just have to scan more products, they can even decide to omit the projects that didn't trigger much bugs. They can't post the results from paying customers in a marketing stunt like this. They mention that they let the developers of the open source projects know about the issues they find. I am wondering how much time the developers get to patch up before they post their results.