Sonar's security research blog, which discloses vulnerabilities in open source software and analyzes developer tooling and package manager flaws.
HN links it as the source for vulnerability disclosures such as Zabbix session storage, RainLoop XSS, and Git integration risks.
Related: RainLoop (of which SnappyMail is a fork) seems to be no longer developed and has a known stored XSS problem: https://blog.sonarsource.com/rainloop-emails-at-risk-due-to-code-flaw/
SnappyMail is not affected by this and seems to be the successor.
Source/Origin article (linked in the "Patch now" section): "Zabbix - A Case Study of Unsafe Session Storage"[0]
[0]: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage
Related: https://blog.sonarsource.com/securing-developer-tools-git-integrations/ ("Securing Developer Tools: Git Integrations")