[scrollaway]

To be fair a contract does not guarantee the security framework of the company you are contracting, which means your code is only as safe as their weakest link.

[NeutronBoy]

Which is why contracts include things like right-to-audit, so you can verify for yourself.