The 3 A's of Open Source Security