I used to audit opensource code for security issues, on a regular basis, and even now before I install a public-facing application I generally have a look at th

I used to audit opensource code for security issues, on a regular basis, and even now before I install a public-facing application I generally have a look at the code. It's not often I spot anything major, but I figure if I have the time I should do it just in case. I often look at the code for PHP-extensions, npm-libraries, and similar that colleagues introduce. Just to be sure there's not anything blatently horrid going on.