https://security.googleblog.com/2021/07/measuring-security-risks-in-open-source.html