> At some point, developers need to take responsibility for the security of their projects. Agreed, but that could be through careful selection instead of roll

> At some point, developers need to take responsibility for the security of their projects. Agreed, but that could be through careful selection instead of rolling your own. And it would be great if there was better tooling for that. Imagine an ecosystem where every module author automatically gets not just a public repo and issue tracker, but also a way to deal with security issues, an indication if all contributors used 2FA for code contribution and package uploads. Then there could be a search for packages where you can say "only give me those with 2FA and a defined security disclosure process, including all transitive dependencies". That wouldn't be perfect, but much, much better than any ecosystem I've seen so far.