> The trouble is, well-done deliberate sabotage is very hard to distinguish from incompetence.

Behold the Underhanded C contest, where the aim of the contest is to deliberately create vulnerabilities disguised as genuine bugs. http://underhanded.xcott.com/