At least two intelligence agencies approached VideoLAN requesting backdoors in VLC. The answer was an unambiguous no. VLC compiles on air-gapped machines, starting from scratch with the compiler itself, uses double-signature verification, and has caught what appears to be a state actor attempting to inject fake binaries into their servers.