[guappa]

You're claiming here that you do a review of all of your dependencies?

[lrvick]

For security critical projects, of course. I even reproducibly bootstrap my own compilers and interpreters.