In reply to Eric Mann.

Eric - I agree. I don't know why it isn't on WordPress.org's github repository instead. I am guessing because 50% of the WordPress security team is made up of Automattic employees, but you're right - there should be a better distinction drawn here. The relationship is symbiotic in nature but very muddy to onlookers.