Ask HN: How do you vet security of a product?

Everytime I install a product or an OSS on my machine via brew for example, I wonder if the product is malicious or has any vulnerabilities. If/How do you evaluate this? Are there sites that I can look for, which have vetted these products.