I am wondering about source code auditing and how hard it would be to fake a build to be audited? Let me explain.
Say I would be a dishonest programmer that would wish to put in some backdoor into the system I would be selling or what have you. I need to get some certifications to make myself look more legitimate, so I decide to undergo source code audit. However, knowing well that my fraud would be detected, I create a spotless version of the code that does not have the backdoor which I would be submitting to the review. Passing that with flying colours, all I need to do now is scrap the fake build and replace it with my own, malicious version that I would proceed to distribute. If someone would get a hold of it, how would they know the code was tampered with?
How would source code audits help to detect a situation like this? How easy would it be to detect?