You&#x27;re not wrong that a correct process dramatically limits classes of issues (I&#x27;ve worked in a very high ceremony requirements-tracability shop). But it still requires the customer to <i>have faith</i> in source code they can not themselves see.<p>As a <i>customer</i>, you can claim what you like about your process and your glory: until I can actually verify the code as part of the deliverable, it&#x27;s just faith on my part. I&#x27;d rather use an open source firewall rather than a closed source firewall, <i>regardless</i> of the claims made by the proprietary company. Again, this is about <i>faith</i>. I&#x27;d like to avoid having it when it comes to security.