> Have you audited this code?

Wrong question. “Are you paid to audit this code?” And “if you fail to audit this code, who’se problem is it?”

I think developers are paid to competently deliver software to their employer, and part of that competence is properly vetting the code you are delivering. If I wrote code that ended up having serious bugs like crashing, I’d expect to have at least a minimum consequence, like root causing it and/or writing a postmortem to help avoid it in the future. Same as I’d expect if I pulled in a bad dependency.

Your expectations do not match the employment market as I have ever experienced it.

Have you ever worked anywhere that said "go ahead and slow down on delivering product features that drive business value so you can audit the code of your dependencies, that's fine, we'll wait"?

I haven't.

Yea, and that’s the problem. If such absolute rock bottom minimal expectations (know what the code does) are seen as too slow and onerous, the industry is cooked!

Yeah, about that, businesses are pushing and introducing code written by AI/LLM now, so now you won't even know what your own code does.

Due diligence is a sliding scale. Work at a webdev agency is "get it done as fast as possible for this MVP we need". Work at NASA or a biomedical device company? Every line of code is triple-checked. It's entirely dependent on the cost/benefit analysis.

"who'se" is wild.

If a car manufacturer sources a part from a third party, and that part has a serious safety problem, who will the customer blame? And who will be responsible for the recall and the repairs?

But we aren’t car business, am we are in joker business.

When was the last time producer of an app was held legally accountable for negligence, had to pay compensation and damages, etc?