> my product should find problems in 3rd party components. Does that mean that say a security vulnerability in openssl is a responsibility of all software whic

> my product should find problems in 3rd party components. Does that mean that say a security vulnerability in openssl is a responsibility of all software which uses them? I think its unreasonable to expect software projects/products to find things like heartbleed. What about bugs in kernel/OS? How many user-mode software can find bugs in kernel/OS?