> Even if you read the code, you have to trust that the code you read is the code a service is actually using. Don't forget to verify the code for the compiler

> Even if you read the code, you have to trust that the code you read is the code a service is actually using. Don't forget to verify the code for the compiler to ensure that hasn't been compromised in order to inject an exploit into the binary at compile time.