"More eyeballs == Secure code" is a massive simplification to get a tweet/soundbite, and a terrible one because it makes implicit so much about what this actually means.

"More eyeballs" is meant to be in contrast to proprietary code, which is assumed to have a limited number of eye balls looking at it.

As for "secure code", there is no such thing as 100% secure, just as there's no such thing as 100% bug free.

It's all about mitigation and potential. There are various kinds of mitigation, of various levels of strength, appropriateness, and utility.

Mitigation of security issues and bugs when it comes to proprietary, closed code is accomplished by actively paying experienced programmers, quality assurance, and security professionals to write, test, and review the code. This is, however, expensive. Which partly explains why some proprietary, closed code has a bad reputation (not the least of which is that, without access to the code, you can't verify the (marketing) claims made by the vendor).

For open source software, the code is accessible and available to be reviewed by able/experienced people. More eyeballs can be on it. This statement should not imply that more, experienced eyeballs actually are on it (but it often is used as such), nor should imply that lay users are expected to uncover and fix security issues/bugs. There's a lot of code on github and sourceforge that no one has ever looked at other than the author, but it's there able to be looked at (and it might be safe to assume that code on github gets a modicum more attention on average than code on sourceforge, ahem). It doesn't imply it in the same way that "proprietary" doesn't imply that it is actually written, tested, or audited by (paid) professionals either.

I think this statement is a bastardization of two other, statements:

- "System security should not depend on the secrecy of the implementation or its components", aka, "security through obscurity" [0]

- "given enough eyeballs, all bugs are shallow", aka Linus's Law [1]

"More eyeballs == secure code" (and Linus's Law) is a statement similar to the Infinite Monkey Theorem[2], and has the same caveats, not the least of which is requiring infinite time and monkeys (or in the case of LL, infinite eyeballs). That doesn't necessarily make it less true, but it does make it less pragmatic. So it's more theory than happens in practice, but it sounds good, seems intuitive, and has been used as a way to encourage/brow-beat proprietary vendors to open source their code (I'm not sure that this has actually worked for anyone, however, because people don't want to use code that has a bad reputation, which actually discourages eyeballs from examining it). Of course, then you get things like phpBB which is open source and notoriously for bad security, which we could say we know because of so many eyeballs using it (if not looking at it). Despite that reputation, it's available and gets used anyway. If this reputation actively discouraged people from using phpBB, then more eyeballs, in the form of users being exposed to insecurity, might yield greater security by people actively avoiding the known, traditionally problematic software in favor of something with a better track record. It is unfortunate that in the case of phpBB, its ubiquity and ease of use trumps that reputation.

Presumably you could combine them both and hire experienced developers, testers, and security professionals to (continuously) audit open source code. This would arguably be better than solely either proprietary code being audited or the code being open source.

There are no silver bullets. You can (attempt to) throw a massive number of eyeballs at the problem, and/or a massive amount of money for the very best eyeballs, but neither guarantees absolute 100% security. And any claims otherwise should be suspect.

[0] https://en.wikipedia.org/wiki/Security_through_obscurity

[1] https://en.wikipedia.org/wiki/Linus%27s_Law

[2] https://en.wikipedia.org/wiki/Infinite_monkey_theorem