Okay this is fun. Audited 10 open source projects I contribute to (30k to 60k stars). 5 came back clean. The other 5 are getting private security reports from me today: an SSRF guard that fails open, a DNS rebinding hole, an allowlist bypass, an auth middleware gap, and a prefix-match bug. I heart Mythos.