Comment by alkonaut

If you really wanted to research how to get malicious code into the highest-profile projects like Linux, the social engineering bit would be the most

Whether some unknown contributor can submit a bad patch isn't so interesting for this type of project. Knowing the payouts for exploits, the question is: how much money would one bad reviewer want to let one past?