One would hope. Yet, SCM security is so lax and such an afterthought that Wheeler had to write a whole piece on it:<p><a href="http:&#x2F;&#x2F;www.dwheeler.com&#x2F;essays&#x2F;scm-security.html" rel="nofollow">http:&#x2F;&#x2F;www.dwheeler.com&#x2F;essays&#x2F;scm-security.html</a><p>After all that, only one OSS project responded with claims to meet many of the requirements. I figure the commercial situation isn&#x27;t much better with most &quot;benefits&quot; existing on paper rather than with strong security.<p>To top it off, anyone defending against nation-states must remember they always attack what&#x27;s below and around the software. Possessing 0-days in OS or management software should let them bypass build-system security to insert stuff in. I&#x27;d say OpenBSD, memory-safe implementation, and highly-assured guard for protocol-level at a minimum if better stuff wasn&#x27;t available.