I understand the concern and usually I point them to a github repository where the library is hosted and show other projects and clients that are using the same library. Sometimes they review the code on github, and everything runs smoothly after that.
But this time the client is a little bit more paranoid. He asked me what kind of security check the library has gone through and told me that their systems are "validated with the top 10 OWASP checks/scans".
After some research the closest thing I found is this document that list top 10 vulnerabilities in web applications in 2010, by OWASP.
Now to my questions:
Even though I'm not a security expert I'm a web developer and I understand the common flaws that can cause vulnerabilities on Web Applications. What I need is some way to prove specially for a non-technical person that this library has been checked at least for minimal threats and exploits and is in fact secure to be used on their website.
What comes to my mind is maybe a neutral company or consultant specialized in web security that can review the code and attest it's quality. Is this a common practice?
When you include libraries from well known companies or Open Source projects that are reviewed by multiple people (like jQuery) this is a very unlikely case. But when you include a script from a small company or a solo developer I can see that as being a concern.
I don't want to look for exploits in my library as I know I have included none. I just want to prove somehow that the code is safe, so users don't have this kind of concern when using it.