This is a reasonable question. Not everyone can do a full audit of the codebase, regardless of how open the source is.