[KayEyeDoubleDee]

Or I guess they could go back to the version before the break in and add in all the good patches again.

But no one knows if the patches are good, right?

[KayEyeDoubleDee]

Sorry. I see what you mean about re-adding the patches.

[dr_who_2]

Anyone who can read the code can look for suspicious commits. Preferably the people who maintain that program. No one person maintains all the programs, so this isn't as big a task as you think it is. Nothing wrong with taking a break from adding more features for a security audit. Certainly the other sites that have similar versions of the same source code should have identical source code.