Excellent question. No, I am not. I am just attempting to use my very limited knowledge on this subject to hopefully further discussion on a topic that feels really important.

I would love other people to jump in and elevate this conversation.

Sure, CVEs might not be the ideal metric. Could you, or anyone else, suggest a better metric?

If GitHub is too lethargic to do even contemplate this type of change, maybe this could be a differentiator for GitLab?