[hnfong]

There's a difference between "you/I can audit it" and "we (collectively) can audit it".

You're not living in a vacuum. The more users (and perhaps more importantly, contributors) an open source product has, the less likely it has intentional backdoors built into it.

[sedatk]

What's your process to validate if that said software has been collectively audited sufficiently?