Projects like this shows that OSS is not a safe haven for security despite how many eyeballs may be on it at any given time.