Securing Open Source