Im generally a coder though i did not do much with java yet. Does the escrow have to check the sourcecode? Really?  Anyone who is doing that would have to be prepared for a serious amount of work.

Besides, im no security expert and would most probably not know all possible problems.