I am sorry, to enroll a primary maintainers need to open a Pull Request with a Yaml file containing their email address?

And people do that? Here is an example PR: https://github.com/anthropics/oss-scanner/pull/139/changes

Did Anthropic just created a largest ever publicly available collection of email addresses of primary maintainers of OSS projects matching this criteria

established projects that have a critical impact on infrastructure and user security

(Quote from Anthropic)

Is it an invitation for every bad actor to scrape pull requests of this single repo, extract email addresses and target those with every fishing/hacking/account takeover attack imaginable?

Is not that insane?

The timing is suspiciously close to the Anthropic’s deal that allowed it to use xAI’s datacenters at a reduced cost. Now we know what was killed to make the room.