I'm not sure if I'd put being open source higher than actually being audited. In theory there's no difference between the 2. In practice being open source means

I'm not sure if I'd put being open source higher than actually being audited. In theory there's no difference between the 2. In practice being open source means that it could be audited while publishing an audit means it was. It's the difference between giving someone money and giving them a lottery ticket for that money. As many programmers admit themselves, it's also their job/duty/etc. to audit open source code but most actually don't especially for the sprawling, complex code. When everybody's responsible nobody is. It's better than closed source and security through obscurity but potential is only valuable if exploited. OSS without audit could be in some cases just as (in)secure as closed source simply because it may provide its own layer of obscurity through complexity and the expectation that "someone" will check. Someone else.