Finding the problems with FOSS (or really any body of closed or open source or object code) usually requires at least challenging assumptions (not "oh yeah I so

Finding the problems with FOSS (or really any body of closed or open source or object code) usually requires at least challenging assumptions (not "oh yeah I sort of see what's going on" but digging in) or real creativity. The thing that seems to drive that is profit or geek-respect motive, so the folks doing said verification would need to be probably not your average bear doing a job or even person pretty interested but multitasking. I think it'd be hard to find and manage such a work and/or volunteer force at scale well enough to really think that a creative and hard-core security review had been accomplished.