[kingforaday]

"Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL."

Interesting they are listing archived projects and not OSS-Fuzz. What's the reason for this?

[squirrellous]

I thought OSS-fuzz still uses the aforementioned sanitizers and fuzz engines. It is not by itself a fuzzing engine.