What kind of security analysis are you running on the package? Stuff like bandit/pyrom?