I notice that several packages that I maintain that include assembly language files showed up in your results, even though the C portions of those packages are, in fact, built with -fstack-protector-strong.  I don't know what can or should be done about this; just thought I'd point it out.  (See gmp-ecm for one example.)

Regards,