'Set it and forget it' attitude to open-source software has become a major security problem, says Veracode