It's starting to look like doing this for open source projects is a good start. They seem to be less capable at this, try to hide the vulnerabilities more, and

It's starting to look like doing this for open source projects is a good start. They seem to be less capable at this, try to hide the vulnerabilities more, and reporting to them is much harder and well organized. Also, based on my experiences with how the Ruby projects does it's bullshit security, the users could really benefit. Thanks for your input Thomas.