I pointed it at the library's git and let it run from there! I validated all the output (vuln description, risk assessment, exploit poc, patch) before reporting to maintainers