[baq]

still need to read them to make sure you don't vendor a trojan in the first place.

[throw-12-16]

auditing is the first step in vendoring a dep by my definition of the practice