There are currently a lot of people auditing source code with AI.

Wouldn’t it make sense to publish the results as some kind of nostr event? It could tie a specific source code version to a code review, signed by the author and allow discovery with web of trust.

This should obviously not be used to publish CVEs but be more for a positive indication.