The Hidden Vulnerabilities of Open Source