Security Auditing of Open-Source Dependencies

You could post this without the Show HN but Show HN itself is for things you've made other people can try which excludes most reading material, take a look at https://news.ycombinator.com/showhn.html