upstream security report 2023