"It's open source, so it's secure."
I hear this all the time. The idea is simple: if the code is public, someone must have reviewed it. Vulnerabilities would be caught. The community would fix them.
I decided to test this assumption with real data.
I took 10 popular open-source Android apps from F-Droid — apps that millions of people use every day — and ran them through my static analysis security scanner. Then I manually verified every single finding against the decompiled APK code.
The result: 60 confirmed vulnerabilities across 10 apps.
