https://www.eff.org/deeplinks/2011/10/guidelines-open-source-security-audits