As far as I know, this doesn’t get information from upstream maintainers. For this to work well, I think we would want actual advisories generated around commi

As far as I know, this doesn’t get information from upstream maintainers. For this to work well, I think we would want actual advisories generated around commit time, embargoed early notification, and a process for publication.