one avenue for many smaller projects (especially open source libraries) is to become a dependency of a huge project like chrome. then the larger project redirects some of their auditing efforts toward your project.