The general question is about Open Source software use. I was told that an audit of the software that uses NHibernate and log4net will probably get a 'finding'. I wanted to find out what others experience with software audits and the use of Apache projects and Open Source in general. Are there 'approved' libraries or generally accepted libraries or what arguments can I use of sources I can refer to to show saftey , security and acceptance of Hibernate/NHibernate?