The fact that Heartbleed remained undetected for two years certainly revealed one uncomfortable truth about the "security by openness" paradigm: the one agent who actually bothers to audit the source code may be the bad guy.