It's called tidelift.com
this looks interesting https://www.bestpractices.dev/en
... from a longer transcript here https://www.infoq.com/presentations/security-supply-chain-os...
... from a longer transcript here https://www.infoq.com/presentations/security-supply-chain-os...
bingo