What is meant by checking that the project is "secure" is checking dependencies against known security issues. While this is useful, this is completely different from what is advertised (I've expected some sort of a heuristic security anti-pattern detector).