Have a look at the Underhanded C contest[1] and see which of those entries (suitably scaled up, possibly spread over several commits by different people) would

Have a look at the Underhanded C contest[1] and see which of those entries (suitably scaled up, possibly spread over several commits by different people) would be likely to be spotted by OSS maintainers or contributors. I'm not sure the 'all bugs are shallow...' applies to actively malicious contributions. In some sense, proprietary software might be more secure, exactly because it doesn't accept contributions from anyone, and can much more easily background-check the people who do work on it. I'm not sure how common OSS projects that don't accept contributions are, but I'm sure they exist. [1] http://underhanded.xcott.com/ http://underhanded.xcott.com/