kind of makes it sound like security research only revolves around auditing sources to find bugs -_-. thats a tiny part of it.