Is the alternative to source every dependency and inspect for any known exploit?

The (current) repo owner perhaps - is https://github.com/QuantumChilipepper

He describes himself as "Spicy Boi"