This is only a partially-accurate description of how most open source projects work. While code review of the core developers is rare, patches from outside con

This is only a partially-accurate description of how most open source projects work. While code review of the core developers is rare, patches from outside contributors typically are scrutinized before being applied. The curl vulnerability was introduced by an outsider's patch so I am troubled that it wasn't noticed before being committed.