All you need to do is sneak in something in an update that gives people access to your server, or creates a vulnerability that allows them to get access. The f

All you need to do is sneak in something in an update that gives people access to your server, or creates a vulnerability that allows them to get access. The fact that itself hosted is actually a really huge concern, because this thing is sitting on your local network with no firewall between it and everything else that you run. It takes very little to put a vulnerability in a piece of code, and unless you have a person combing every commit with a fine tooth comb, even the fact that it's open source cannot prevent that. No single security measure is bulletproof. Being open source does not counteract the misaligned incentives.