> Given this, is code review of internal code enough to trust quality & security of what we ship? No single thing is enough for this. Code review is an importa

> Given this, is code review of internal code enough to trust quality & security of what we ship? No single thing is enough for this. Code review is an important part, though (assuming it's properly done, which it isn't in the vast majority of cases, it seems). > Does anyone ever realistically considered reviewing OSS code used in your projects? In spots, yes. As a whole, no. Depending on the size of the codebase, the time and effort required to do so would often change the economics such that it would be better just to develop the code in-house. As an unimportant aside, I am skeptical of this assertion: > Linux Foundation survey says 70-90% of modern software constitute open source code.