How to Navigate Open-Source Security Without Stifling Innova