On the one hand, I'm also somewhat disappointed. On the other hand, Veracode's central product is a scanner. I cannot even begin to imagine how to consistently

On the one hand, I'm also somewhat disappointed. On the other hand, Veracode's central product is a scanner. I cannot even begin to imagine how to consistently evaluate the boring, manual, operational parts of a security program in the context of open source libraries. How does one assess the security training and operations of a library developed and maintained by three people?