Maybe graph the rate of vulnerabilities discovered vs. LoC/files added? It's safer to only use vulnerability counts as a metric for how interesting software is

Maybe graph the rate of vulnerabilities discovered vs. LoC/files added? It's safer to only use vulnerability counts as a metric for how interesting software is to security researchers.