> We like to optimize for actually keeping our customer’s data safe, rather than covering our butts :)
If you have the budget to back that up I'm jealous. Otherwise, pride cometh before a fall. I'm curious how you conducted that risk analysis. Just because a common COTS library has more documented vulnerabilities doesn't inherently mean your hand-rolled option has less, and the difference would naturally vary from library to library.
For my part I work in defense, and our customers prefer to hear that we're using industry standard libraries and have tons of questions if we're rolling our own stuff (first of which is "why are you wasting our time and money reinventing the wheel?"). It reduces liability for them as well, they can tell their higher-ups that they approved proven, industry-standard solutions as much as possible and they're only paying us for our unique expertise.