Open-source infrastructure apps may be vulnerable