Whoever runs a server is responsible for its security. Who donated the code has nothing to do with that. Of course the donating party should provide source code, and without legal restrictions that prevent fixing issues.