Disclosure-channel coverage across reviewed repos

A method note in the Bitcoin Red Team thread whose parent, held at callebtc-2085418268689391792, reports 425 projects scanned and 1,029 high and critical findings. It says the campaign's biggest bottleneck is not finding bugs but reaching maintainers: of 426 reviewed projects only 19.5 percent, 83 projects, publish a SECURITY.md, and only 13.1 percent, 56 projects, have an extractable security email, with 28 routing through GitHub advisories and 408 repositories resolved. The attached chart is the source of those figures, and the ask is that maintainers leave an email address in their repositories. Held because it quantifies a coordination problem the incident exposed, and because it bears directly on the responsible-disclosure argument recorded elsewhere in this register. Interest: calle leads the campaign whose reporting volume was itself being criticised at the time. The percentages are the campaign's own measurements and are not verified here.