It would be nice if I automatically received the latest 'vulnerabilities' file with each pkgsrc cvs update. How about putting a copy in pkgsrc/security/audit-packages/ and then modifying the audit script to check that location _and_ pkgsrc/distfiles/, using whichever is newest?