When integrating source material from an open source project into a highly secure environment, which of the following precautions should prevent hidden threats?

A design review evaluates the architectural approach of a system but does not inspect actual source code for hidden malicious logic.

When integrating open source code into a secure environment, a thorough code review allows security personnel to manually inspect every line for logic bombs, backdoors, obfuscated malicious functions, or insecure coding practices that automated tools may miss. This directly addresses hidden threats that could be intentionally embedded by a malicious contributor.

A risk assessment identifies and evaluates potential risks at a high level but does not involve direct inspection of source code for embedded threats.

A vulnerability scan identifies known, publicly documented vulnerabilities using signatures, but will not detect novel or custom-written malicious code hidden in the source.