> If someone hacks the app using your library.

Sorry, but I still don't understand what you mean here. There could be a bug in the library in the same manner that there could be bugs in any other open source library. Could those bugs become a security issue for your app? Yes, they could. Despite of this we all use open source software, right?

Let's say you were using Active Merchant[1], would you sue Shopify if someone hacked your app to process irregular payments through your Bank's payment gateway (accessed by Active Merchant [2])?

[1] https://github.com/activemerchant/active_merchant

[2] https://github.com/activemerchant/active_merchant/tree/maste...