Open source must be safe