From Josh Bressers, dealing with an open source project:
"He didn't know what CVE was before I spoke to him, now he's getting CVE warnings from github and is like "o hey, this is a thing""
I suspect if nothing else github.com CNA/warnings will probably be more publicity than we've ever had (it's really in peoples faces...). Just a heads up.