Yeah, they are. Recursive checking of libs as suggested doesn't take 30 minutes, or otherwise nobody would complain. And what if you missed something because no

Yeah, they are. Recursive checking of libs as suggested doesn't take 30 minutes, or otherwise nobody would complain. And what if you missed something because nobody checks thoroughly the library code in 30 minutes - one will certainly obfuscate any malicious procedure. Also you can outsource the tests and its easy to do. Depending on the contract, they can even be held liable if you come to get owned via the method that should have been tested.