How can you _prove_ (“demonstrate”) that your software doesn’t contain malware or any vulnerabilities?

They can’t do that for any of their own software for sure…