[lrvick]

Shipping code to production without evidence anyone credible has reviewed it at a minimum is negligence.

[guappa]

You're claiming here that you do a review of all of your dependencies?

[lrvick]

For security critical projects, of course. I even reproducibly bootstrap my own compilers and interpreters.