# Chapter 7. Security and Version Control

> Explains that vulnerabilities in open source projects are disclosed alongside the fix process, and that although security and version control are not part of compliance due diligence, scan service providers may address them separately.

---

LLMS index: [llms.txt](/llms.txt)

---

It is generally accepted that software ages like milk, not wine. And security vulnerabilities are a concern in all code, whether open source or not. However, in open source projects, these vulnerabilities are publicly exposed alongside the process of fixing them. This exposure can occur either before or after a fix is applied, and older open source code may harbor vulnerabilities that are actively exploited in the wild. Security and version control are not part of the open source compliance due diligence process, but companies that provide source code scanning services sometimes also offer a service that maps identified open source components against known open source security vulnerabilities.