Not on the TOC, so hope it's ok to comment. I have the same concerns as Liz, quite often metrics are gathered without all factors considered. Take kubernetes for example, huge code base, huge user bas

Should we make it mandatory (which I think is a good idea), it would be useful to cross reference kubernetes who took the same approach for all leaders (I did the course as part of product security).

Add me as well. I am one of the maintainers on bandit (python ast based security linter) which hits around 25k downloads a day, so I have a fair amount of experience in what works / does not work well