I am just a student and have only made college projects. I have another college project to work on, but I am aiming to take a professional software engineer approach. An approach like you are building a product for production and making money, which comes with actual responsibility.

My first question is how do professionals trust some open source tool to use in their project? Not just for security but also for reliability. For example, I previously used this tool called Varlock which greatly simplifies storing and retrieving secrets. It supports plugins for a lot of providers, so you don't have to code directly against a single secrets management provider. Most people just use the provider that comes with the platform they are going to host on, but since I could be juggling between different platforms to stay under the free tier, Varlock becomes useful.

But how can you trust it for production purposes, especially that it is relatively new? And how would you trust updating it?…