Flux — #opensource

GitHub can assign CVE IDs for any GitHub-hosted project. Most OSS projects don't need to become their own CNA.