Someone posted a graphic that was like 390 out of 391 projects were flagged as vulnerable. Once again, good opsec and responsible disclosure is to go thru back channels to give devs a chance to remediate THEN you spill the beans.