it appears that hsec-tools now theoretically can also report problems with ghc tooling. This should be reflected in cabal-audit