Virus scan is only 1% of security. Eg. How do I know with any certainty that a library passes all OWASP best practices? Or is well documented? Or is maintained

Virus scan is only 1% of security. Eg. How do I know with any certainty that a library passes all OWASP best practices? Or is well documented? Or is maintained? Or is responsive to security reports? [… and dozens of other similar properties]