It is generally accepted that software ages like milk, not wine. And security vulnerabilities are a concern in all code, whether open source or not. However, in open source projects, these vulnerabilities are publicly exposed alongside the process of fixing them. This exposure can occur either before or after a fix is applied, and older open source code may harbor vulnerabilities that are actively exploited in the wild. Security and version control are not part of the open source compliance due diligence process, but companies that provide source code scanning services sometimes also offer a service that maps identified open source components against known open source security vulnerabilities.
This is the multi-page printable view of this section. Click here to print.
Chapter 7. Security and Version Control
Explains that vulnerabilities in open source projects are disclosed alongside the fix process, and that although security and version control are not part of compliance due diligence, scan service providers may address them separately.