THE OPEN-SOURCE LANDSCAPE

THE RISK OF RELYING ON OPEN SOURCE WITHOUT REVIEW Free does not mean safe. Anyone can publish open-source work, including people with careless habits or bad intentions. Several risks are worth naming. Abandonment: the maintainers stop updating it, and security problems stay unfixed. Insecure defaults: a starter template might grant an agent broad permissions, such as running any command, because that made the demonstration easy. Malicious or compromised packages: attackers sometimes publish code with names similar to popular ones, or take over a real project and slip in harmful changes, which is the supply-chain danger covered in Chapter 39. Hidden dependencies: your chosen project may pull in dozens of others, each with its own risks. License trouble: using code in ways its license does not allow can create legal problems for your organization. Run the same review you would run on any outside code, as described in Part Nine. Use a short checklist. Maintenance: when was the last meaningful update, and are problems answered? Security history: have past vulnerabilities been reported and fixed quickly? Community: how many people use and contribute to it, and is there more than one maintainer? Licensing: does the license allow your use? Contents: do the defaults follow least privilege, and does it make network calls or run commands you did not expect? Try it in a sandbox first, as you learned in Part Nine, before connecting it to anything valuable. Finally, give back when you can. Reporting a bug clearly, improving documentation, or sharing a fix keeps the garden healthy for everyone.