Coverity regularly scan open-source C/C++ projects and email contributors reports.

I've received a few such emails. Its a good way to market developer tools.