@inthehands meanwhile, github imposes vendor security obligations on people just for having one commit in a non-trivial project