> the secdb has so far been an experiment, but seems like people are actually using it, so I should set up some proper automated testing.
I doubt there is a better source :)
I can point you at the various fixes for things I've reported since this first became available, but given your skepticism I'm sure it would not help since he seems to exclusively use the changeset description: "[add] various fixes" with no attribution.
Here's the link for that last bit: https://git.alpinelinux.org/cgit/alpine-secdb/log/
¯\_(ツ)_/¯