This is one scenario where the GenAI has been pretty useful, to a point.
It can help someone review code. It has a lot of false positives, but it does occasionally catch something, and I can forgive the false positives, even if they are super annoying and time consuming, so long as it is catching something on occasion.
In open source, a problem is so many people in your community now want to 'help' by using their AI subscriptions to review the existing code and then spam the project with their 'findings' because they don't understand well enough to double check the AI. This greatly amplifies the false positive problem with mind numbing volume of dupes.