Open Source doesn't automatically mean safety