FFmpeg has been accepted in the EU funded @yeswehack project for security developers to find vulnerabilities. No thought has been put into funding the volunteers who actually have to fix the bugs for free.