Most trackers start from a CVE and work back to the commit. These reports go the other way: each week the commit hunter scores every WebKit source commit for security-fix signals, an LLM triages the candidates, and the exploitable-grade ones get a full root-cause analysis, PoC and detection writeup — before any advisory names them.