content: Because contrary to popular belief -- not everyone has the skills and time and give-a-fuck to security check every open source program out there. People like to think because it's open source there's more eyes and thus a greater chance of being caught -- and to some extent that's true -- but closed doors also make the same bugs harder to find. Unless your project draws in someone important then don't expect it to be secure. Simple as that. Worse off, many programmers write insecure code through sheer ignorance. I know very few programmers who know anything much about crypto. I mean -- in so bad as to have a statically compiled in salt instead of letting the user define it. Hell -- many wouldn't even know how to obfuscate it statically compiled! They'd just call it "salt". So, even if it's open source -- someone would just cat and pipe into grep.. boom. Found the salt. So let's back up to why this is the case. Programming is a huge field. You have a user interface, back end, database. Learning those three alone takes time. Add in unit testing and that adds more time. Add is basic security and now you have to start all over on the interface, back end, and sometimes the database (stored procs, for instance). Now add in advanced security and you start all over again. Many programmers don't make it to more than basic security and I mean basic for different reasons. They never have time to go back and make things right but most of all the never have time to learn any better -- swoosh, off to the next project. We'll lock that old one down one day... one day... never. These same programmers come home and work on projects... all without that time and experience in security and never learning. It's fun for a very small select few anyways, so that's a tiny slice of the pie you're hoping looks over a metric fuck ton of code all over the OSS world. If you want something serious to happen... start a security crew. Go project to project doing an audit. So, for instance, let's start with something simple like sprintf. Pick a project and start building a checklist with sprintf being top of the list. I'd suggest checking out OpenBSD's experiences first -- they went through a fairly thorough audit and have very good practices. tl;dr: do it yourself or it won't get done