> Say a company sells SaaS and relies on open source nginx which is found to contain such vulnerability? Then that SaaS company would be liable (unless they pu

> Say a company sells SaaS and relies on open source nginx which is found to contain such vulnerability? Then that SaaS company would be liable (unless they purchased nginx)? If you take someone's FOSS and create a product with it, then of course your customers will look to you when that product has a defect.