I can think of several ways: log analysis, methodology analysis, analysis of code comments writing style/errors, keeping the vulnerability in and finding home calls, human intelligence.

Good initiative, not the best name.

Open Geospatial Consortium (also OGC) is leading in its domain and has been for years. https://www.ogc.org/

Not listed in the article: I like Detrumpez Vous best. It has been around for a while, and yes, it is offered in English as well.

https://play.google.com/store/apps/details?id=com.detrumpezvous.app