If there were 'major issues with the code' how do they manage to get assessed as having the highest level of security or whatever it is that they have been tested for? Surely that process is vigorous. How could the testers say that if there was major flaw?