Publishing scan results for all Fedora packages might not be very good idea,
since the static analysis can find issues with possible security impact.
Also Coverity offers their tool to open-source projects for free [1]. I think
some projects are already using it (at least Squid). So if upstream projects
are interested, they can sign up for free.