Pick something that resembles a vuln→patch interval, not just a context-less number that means they're popular, audited, or reviewing their OWN code all the ti

Pick something that resembles a vuln→patch interval, not just a context-less number that means they're popular, audited, or reviewing their OWN code all the time. Instances where 0-days can't be used in isolation are a perfect example of where nontechnical people absolutely need to "just trust" someone to triage, and perform threat modeling for them.