This just goes to show that "it's open source" is never sufficient to make a case that the code is correct, secure, or even works.
Only when people build on that code and actively use it in their own projects do these kinds of bugs get found. And NVK spent his every waking hour to ensure that never happened.
