New tool idea: oss-find-author

A common problem for security researchers is identifying how to privately contact the author of the project (e.g. not creating a public issue). There's some structure here, and some sleuthing involved, but I'm not aware of any tools that handle this.

Since we already have oss-metadata (which we need to finish), we can leverage that and add a bit:

• Gather metadata (per package manager), identify author/maintainer list.
• Look through Git commit logs for committer/approver email addresses.
• Search for references in a SECURITY.md, CONTRIBUTORS.md, or similar.
• Look for Twitter account references (and maybe some others)

There are probably some other good places to look.

Somehow, sort these in a way that makes sense and provide the output in a way that makes it clear where the data came from, e.g.

oss-find-author pkg:pypi/django

[ 100% ] foundation@djangoproject.com (via PyPI author_email field)
[ 95% ] example@example.com (top contributor in past year, found on website linked from user profile page)
[ 40% ] ...

Start by reviewing the existing oss-metadata work and its package-manager metadata flow. Then map how Git commit logs, SECURITY.md, CONTRIBUTORS.md, linked profiles, and Twitter references could be gathered and ranked. Done means a proposed or implemented oss-find-author command clearly reports contact data, confidence, and each source.