Usually it is just rubber stamping the results of a tool like black duck, Vera code , or any scanner and the ongoing maintenance around that. Not to mention ho

Usually it is just rubber stamping the results of a tool like black duck, Vera code , or any scanner and the ongoing maintenance around that. Not to mention how you configure the open source also affects if you could be vulnerable to a cve.