A claimed source-code compromise at a security vendor. Code is not a signing key — but it is a map of the detection logic.