Look inside that "commercial" software of yours, chances are that it bundles both five crappy js libs but also a vulnerable version of gzip. Large parts of the

Look inside that "commercial" software of yours, chances are that it bundles both five crappy js libs but also a vulnerable version of gzip. Large parts of the code of any non-trivial software package will be open source code. There are literally people who makes their living from pointing these things out. Unless your software is among the absolutely most widespread, chances are it's not audited at all. (Also, can we please leave the perceived distinction between "commercial" and "open source" in the 90s where it belongs?)