So, we're only interested in sending security notices. We don't care about being notified about every dependency out there. As a result, the hard part is colle

So, we're only interested in sending security notices. We don't care about being notified about every dependency out there. As a result, the hard part is collecting info on vulnerable dependencies. We solved this problem for Ruby by… co-maintaining an open source database https://github.com/rubysec/ruby-advisory-db/ https://github.com/rubysec/ruby-advisory-db/ – which everyone is free to use. We don't have the resources to do this for every community :).