A Layered Approach to Managing Risks in OSS Projects