Yeah, safe and open source are not necessarily synonymous. (see openssl "heartbleed")