Drive or dive: Assessing the risks for developers and how those risks are managed