We have an open source PHP application and we’ve been fielding dozens of questions asking if the app is vulnerable - even from IT managers / system admins who i

We have an open source PHP application and we’ve been fielding dozens of questions asking if the app is vulnerable - even from IT managers / system admins who in my mind, should know better. This has me thinking no one cares anymore about the stack of software being used - it’s almost sad to think about how it is going to be get worse with insane dependencies software comes with nowadays. I’m thinking there’s a business opportunity for someone to curate list of software and it’s dependencies and provide subscription service for vulnerabilities alert on the stack of said software. PS: Looks like Vuldb [0] is halfway there, but wonder if they alert based on dependencies or even version of said application / product. [0] https://vuldb.com/?kb.alerting https://vuldb.com/?kb.alerting