> The article makes a good point that it's very hard for small projects, like the team running Homebrew, to fund their security, yet they are likely to be a tar

> The article makes a good point that it's very hard for small projects, like the team running Homebrew, to fund their security, yet they are likely to be a target for quite high end attackers, given the access that can be gained by getting unauthorised access to package repositories. I know this is kind of a shameless plug, but this is the exact reason I launched BountyGraph [0] last week. I think that we can crowdfund security budgets for these projects to help encourage the discovery of issues like this one. [0] https://bountygraph.com/ https://bountygraph.com/