In 2023, During a security assessment of Masa CMS, an open-source content management system.

We discovered 11 vulnerabilities in Masa CMS, some allowing server takeover.

Why does it matter? Because it's easy to assume that "if it's open source, someone must have already reviewed it."

But the truth is:
No one looks until someone really looks.

Now, imagine if these vulnerabilities had been found by a malicious actor instead of a security researcher…