Open-Source Security Paradox: More Code, More Validation