It is reasonable to trust your developers but not trust unaudited third party code.