Veracode finds glaring gap in open source security and says despite inherent risks of open source code, good software security posture is still lacking.