Have you considered using LLMs to perform some automated more-or-less reliable classification of incoming reports by severity, affected product, etc., then have agents try to replicate the reported findings?
Ideally the reports would also be coming in in the same structured format.
I recall the AUR always being touted very highly as some great advantage for Arch as a linux distro, unfortunately this convenience has also come with a price.
It's crazy that all it takes to become a maintainer of a package is to flag it as orphaned, wait 2 weeks for the original maintainer to fail to respond because they're on a holiday, and BAM! - the attacker can gets assigned as a maintainer and can now ship spicy updates.
Firecracker and gVisor are used by AWS and GCP, respectively, are open source. That's just off the top of my head, I'm sure there's more, there's also the whole Open Compute Project, after all.
Ideally the reports would also be coming in in the same structured format.