how do OSS projects even know unless that single engineer tells them or opens a github/etc issue or something like that?