# code security Code security is the practice of protecting software source code, dependencies, and configuration files from vulnerabilities, including throughout the software development lifecycle. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Putting models to the secure coding test: Plan vs default mode DevFeed: [Putting models to the secure coding test: Plan vs default mode]() Original publisher: [Read original article]() Author: Kennedy Toomey Published: 2026-08-19T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [AI-assisted coding](), [Application Security](), [code security](), [Code quality](), [Vulnerabilities](), [Claude](), [cursor](), [codex]() Tags: [application-security](), [claude](), [code-quality](), [code-security](), [codex](), [command-line](), [cursor](), [supply-chain](), [vulnerabilities]() ### AI overview This article describes an experiment comparing plan mode with default mode for secure code generation. The author tested Sonnet 5, Composer 2.5, and GPT 5.5 through Claude, Cursor, and Codex, using security and code-quality analysis to assess the results. ### Source excerpt We tested Sonnet 5, Composer 2.5, and GPT 5.5 in plan mode and default mode to see whether plan mode produces measurably more secure code. ## Capital One Announces Open-Source VulnHunter Agentic AI Code Security Tool DevFeed: [Capital One Announces Open-Source VulnHunter Agentic AI Code Security Tool]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-17T17:01:41Z Content type: release Language: en Sources: [Capital One Tech]() Topics: [open-source-security](), [code security](), [Artificial Intelligence](), [Open Source](), [Vulnerabilities](), [Tooling](), [Developer experience]() Tags: [agentic-ai-security](), [ai-code-security](), [ai-security](), [build](), [claude-code](), [code-vulnerability](), [developer](), [developer-experience](), [developers](), [exploit](), [generative-ai-tools](), [open-source](), [vulnerabilities]() ### AI overview Capital One announces the open-source release of VulnHunter, an agentic AI security tool that analyzes source code from an attacker's perspective. It is designed to identify potentially exploitable defects, map prospective attack paths, and propose targeted code remediations. ### Source excerpt Capital One's open-source, agentic AI code security tool. The rules of software security are changing faster than most defenders can keep pace. Advanced AI models have dramatically lowered the barrier for bad actors to discover and exploit vulnerabilities in software. What once required significant skill and time can now be automated, accelerated, and scaled. The world faces an increasingly short window of time before highly sophisticated, next-generation AI attack capabilities become affordable and accessible to virtually every adversary. Across the industry, organizations are racing to prepare for this paradigm shift. Traditional environmental protections like network segmentation, identity controls, and monitoring remain essential, but are no longer sufficient on their own. The ultimate defense in this new reality requires a shift in approach: organizations need to consider and detect the vulnerabilities in their code and fix them before adversaries can deploy advanced models to discover and exploit them. At Capital One, we decided that the right response to AI-enabled threats wasn't to wait, but to build cutting-edge AI-driven defenses and put them in the hands of defenders everywhere. That's why we are announcing today the open-source release of VulnHunter, an advanced agentic AI security tool designed to apply proactive, attacker-perspective analysis directly to the source code. Developed internally at Capital One, VulnHunter is not a traditional, passive vulnerability scanner. It represents a shift in defensive tooling with an agentic reasoning workflow to identify potentially exploitable defects, map prospective attack paths, and propose highly targeted code remediations. Built for the developer experience To fully unlock the utility of VulnHunter, we knew ease of use mattered. A persistent challenge with traditional security tools is that they are often built primarily to enforce rigid cybersecurity practices, without much consideration for a developer's ac ## Introducing Gemini 3.5 Flash Cyber DevFeed: [Introducing Gemini 3.5 Flash Cyber]() Original publisher: [Read original article]() Author: Raluca Ada Popa; Four Flynn Published: 2026-07-17T15:00:11Z Content type: article Language: en Sources: [Google DeepMind News]() Topics: [code security](), [Cybersecurity](), [Vulnerabilities](), [Artificial Intelligence](), [Code](), [Language models](), [Google]() Tags: [code](), [code-security](), [cybersecurity](), [efficiency](), [gemini](), [google](), [model](), [models](), [scale](), [security](), [software](), [vulnerabilities]() ### AI overview Google introduces Gemini 3.5 Flash Cyber, a lightweight cybersecurity model built on Gemini 3.5 Flash and fine-tuned to find, validate, and patch software vulnerabilities. The article describes its use through CodeMender, its efficiency for scanning large codebases and codepaths, a limited-access pilot for governments and trusted partners, and planned customer access through the Gemini Enterprise Agent Platform. ### Source excerpt Google introduces Gemini 3.5 Flash Cyber, a lightweight cybersecurity model to find and patch vulnerabilities. ## Technology Short Take 197 DevFeed: [Technology Short Take 197]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-06-19T14:00:00Z Content type: opinion Language: en Sources: [Scott's Weblog]() Topics: [networking](), [Artificial Intelligence](), [code security](), [Vulnerabilities](), [cloud security](), [Amazon Web Services](), [Kubernetes]() Tags: [ai](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [code-security](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [open-source](), [security](), [technology](), [vulnerabilities]() ### AI overview A commentary roundup covering radical network redesign at AWS, quantum computing's implications for encryption, AI's effects on certifications and code security, AI agent exploits, open-source vulnerabilities, Kubernetes resources, cloud operations, the AI bubble, and AWS IAM guidance. ### Source excerpt Welcome to Technology Short Take 197! I've been traveling for business for the last week, so this Technology Short Take has a tad fewer links than I typically include. Even so, I still have links on radical new network designs, the impacts of AI on code security, things beginners get wrong about AWS IAM, and more! Let's get into the content. Networking This story about a radical network redesign at AWS--along with this accompanying arXiv paper--was intriguing to me. I'm not a networking expert, but designing networks with quasi-random connections between endpoints definitely flies in the face of the traditional wisdom. I do wonder, though, if this is the sort of technology that only makes sense for the hyperscalers, and not for the rest of us. Doug Dawson provides a quick update on current encryption standards and what he terms the "pending encryption crisis" presented by quantum computing. It would appear that AI is affecting even Cisco's well-known industry certifications, as outlined by Daniel Dib. Security CodeRabbit shared the results of an analysis of PRs to open source projects showing that AI-written code produces ~1.7x more issues. Along the same lines, Jens Wessling of Veracode indicates that 45% of all AI-generated code samples contained OWASP Top 10 security vulnerabilities. Anyone who didn't expect seemingly-dangerous AI agent security exploits to appear hasn't been paying attention. Enterprise AI tools don't appear exempt, either. The complex interdependencies of open source software projects once again means that a single critical vulnerability threatens a much larger number of projects and tools. Cloud Computing/Cloud Management This is an older post, but the author recently updated it--check out Marcus Noble's recommended resources for Kubernetes newbies. I am not yet sure about pulumi do (direct operations for any cloud resource; see the Pulumi blog post about it). On one hand, I can see the utility in situations where you "just need a quick" whatever ## How Dropbox uses MCP and Dash to close the design-to-code security gap DevFeed: [How Dropbox uses MCP and Dash to close the design-to-code security gap]() Original publisher: [Read original article]() Author: Yasmin McDowell,Lawrence Good,Ilya Yakovlev,Andrew Cheung,Binoy Dash,Simran Jumani,Dmitriy Meyerzon,Mark Breitenbach,Ishan Mishra Published: 2026-06-12T18:00:00Z Content type: article Language: en Sources: [Dropbox Tech Blog]() Topics: [Model Context Protocol](), [code security](), [Security](), [Code review](), [Artificial Intelligence](), [Language models]() Tags: [agentic-ai](), [agents](), [ai](), [code-quality](), [code-security](), [developer](), [developer-tools](), [engineering](), [mcp](), [review](), [security](), [workflow]() ### AI overview Dropbox built an agentic AI system combining Model Context Protocol, foundational large language models, and Dash to retrieve relevant threat models during code review. The system evaluates whether code changes align with documented security requirements and helps expose gaps between design decisions and implementation. ### Source excerpt Using an agentic AI system to surface threat models during code review and spot gaps between security requirements and implementation. ## Detect source code attacks with Datadog Code Threat Detection DevFeed: [Detect source code attacks with Datadog Code Threat Detection]() Original publisher: [Read original article]() Author: Kassen Qian; Daniel Blazquez; Christoph Hamsen Published: 2026-06-09T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [threat detection](), [GitHub](), [GitHub Actions](), [Pull Request](), [CI/CD](), [code security](), [AI-assisted coding](), [Application Security]() Tags: [agent](), [agents](), [ai](), [attacks](), [ci](), [ci-cd](), [code-security](), [devsecops](), [github](), [github-actions](), [pull-requests](), [review](), [secrets](), [security](), [supply-chain](), [threat-detection](), [vulnerabilities]() ### AI overview Datadog Code Threat Detection analyzes GitHub pull requests with AI-assisted analysis to identify malicious code changes and attempts to compromise CI/CD pipelines, secrets, and release workflows. ### Source excerpt Learn how Datadog Code Threat Detection helps teams detect malicious pull requests and source code attacks targeting CI/CD workflows, secrets, and software releases. ## AI Is Building Your Attack Surface. Are You Testing It? DevFeed: [AI Is Building Your Attack Surface. Are You Testing It?]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2026-03-19T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [code security](), [AI-assisted coding](), [Large Language Model](), [AI Bots](), [Benchmark](), [Back end](), [Code]() Tags: [agents](), [ai](), [ai-agents](), [awareness](), [benchmark](), [blog](), [code](), [code-generation](), [code-security](), [coding](), [executive](), [pmm](), [snyk-platform](), [testing]() ### AI overview AI-generated code is accelerating development while introducing serious security risks: 62% of LLM-generated backend code evaluated by BaxBench was broken or insecure, and about half of the code that worked remained exploitable. The article argues that static analysis is necessary but insufficient, and that runtime testing is needed to assess real exploitability. It also highlights AI agents as an expanding attack surface because they increasingly call privileged and undocumented APIs. ### Source excerpt Speed has outpaced validation. With 62% of LLM-generated code testing as insecure and AI agents using undocumented APIs, legacy tools fall short. Learn how Snyk's AI-powered dynamic testing secures your expanding attack surface. ## Claude Code Security: A Welcome Evolution in the Remediation Loop DevFeed: [Claude Code Security: A Welcome Evolution in the Remediation Loop]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2026-02-23T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Claude Code](), [anthropic](), [Vulnerabilities](), [AI-assisted coding](), [Application Security](), [Securing AI](), [code security](), [Large Language Model](), [Frontier AI](), [vulnerability]() Tags: [ai](), [ai-security](), [anthropic](), [application-security](), [awareness](), [blog](), [claude-code](), [code-security](), [cybersecurity](), [devops](), [devsecops](), [executive](), [frontier-ai](), [interest](), [llm](), [open-source-security](), [pmm](), [review](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [tech](), [validation](), [vulnerabilities]() ### AI overview Claude Code Security is presented as a major advance in vulnerability discovery and patch drafting, but the article argues that enterprise security still requires deterministic and dynamic validation, remediation automation, and governance. It emphasizes that secure code generation remains difficult because AI-assisted development can introduce business logic, authorization, injection, and cross-file vulnerabilities. ### Source excerpt Anthropic's Claude Code Security marks a major shift in vulnerability discovery, but AI-driven development requires more than just reasoning to remain secure. Learn how Snyk's AI Security Fabric integrates with Claude to close the loop between finding vulnerabilities and fixing them at scale. ## Scan your AI-generated code from Cursor using Model Context Protocol (MCP) DevFeed: [Scan your AI-generated code from Cursor using Model Context Protocol (MCP)]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2025-06-23T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [cursor](), [MCP Server](), [Model Context Protocol (MCP)](), [code security](), [Vulnerabilities](), [interoperability](), [Command-line interface](), [snyk-code]() Tags: [ai](), [ai-assistants](), [application-security](), [awareness](), [blog](), [cli](), [code-security](), [cursor](), [customer](), [developer](), [interoperability](), [mcp-server](), [model-context-protocol-mcp](), [open-source-security](), [related-content](), [security](), [snyk-code](), [vulnerabilities]() ### AI overview This article explains how Snyk's CLI MCP server integrates with Cursor to provide in-agent security for AI-generated code. It describes real-time detection of known vulnerabilities in code and open-source packages, with minimal configuration through MCP interoperability. ### Source excerpt Secure your AI-generated code from Cursor in real-time with Snyk's CLI Model Context Protocol (MCP) server. Detect vulnerabilities and accelerate secure development without compromising agility. ## Snyk Security Solution Now Integrated into Google Cloud's Gemini Code Assist DevFeed: [Snyk Security Solution Now Integrated into Google Cloud's Gemini Code Assist]() Original publisher: [Read original article]() Author: Liqian Lim (林利蒨) Published: 2025-04-09T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [Artificial Intelligence](), [Application Security](), [code security](), [ide](), [AI Development]() Tags: [ai](), [application-security](), [awareness](), [blog](), [code-security](), [executive](), [gemini](), [google](), [pmm](), [related-content](), [sast](), [snyk](), [snyk-apprisk](), [snyk-code]() ### AI overview Snyk's security solution is integrated into Google Cloud's Gemini Code Assist, enabling developers to use Snyk security capabilities through natural-language prompts and the coding assistant's chat interface. ### Source excerpt Secure AI coding with Snyk and Google Gemini. Learn how Snyk Code's SAST integrates with Gemini Code Assist for seamless, secure development workflows. ## Snyk Code Improves Contextual Dataflow Analysis for Taint Vulnerabilities DevFeed: [Snyk Code Improves Contextual Dataflow Analysis for Taint Vulnerabilities]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-10-10T05:00:00Z Content type: release Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk-code](), [code security](), [Vulnerabilities](), [Security]() Tags: [awareness](), [blog](), [code-security](), [data](), [developer](), [devrel](), [feature](), [security](), [snyk](), [snyk-code](), [vulnerability](), [xss]() ### AI overview Snyk Code introduces an improved contextual dataflow view for taint vulnerabilities. The update highlights the critical steps in a dataflow path so developers can assess potential true positives and address security issues more efficiently. ### Source excerpt Snyk Code's enhanced dataflow analysis simplifies vulnerability identification and remediation. Learn how this powerful tool streamlines the security process and saves developers valuable time. ## What you should know about PHP code security DevFeed: [What you should know about PHP code security]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-09-04T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [PHP](), [code security](), [Vulnerabilities](), [Sanitization](), [web applications](), [SQL](), [Laravel](), [WordPress](), [Databases]() Tags: [awareness](), [blog](), [code](), [code-security](), [developer](), [devrel](), [env-file-security](), [laravel](), [php](), [security](), [snyk-code](), [sql](), [vulnerabilities](), [web-applications](), [web-development](), [wordpress]() ### AI overview An overview of PHP code security, covering common causes of vulnerabilities, SQL injection risks, input sanitization, prepared statements, secure coding, dependency and infrastructure scanning, and the business consequences of breaches. ### Source excerpt Let's discuss the importance of PHP security and the business impact of some notable PHP interpreter vulnerabilities that are crucial for developers to get right. ## The journey to AppSec gold: Lessons we can learn from the Olympians DevFeed: [The journey to AppSec gold: Lessons we can learn from the Olympians]() Original publisher: [Read original article]() Author: Krysta Williams-Timm Published: 2024-08-15T05:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Development](), [Security](), [code security](), [Artificial Intelligence]() Tags: [application-security](), [awareness](), [blog](), [building](), [code](), [code-security](), [collaboration](), [consistency](), [developer](), [developers](), [development](), [megawatt](), [security]() ### AI overview The article uses Olympic training as an analogy for achieving application security excellence. It emphasizes consistent effort, collaboration between security and development teams, integration with existing developer workflows, practical remediation, and an asset-first focus on continuous improvement. ### Source excerpt In honor of the upcoming Olympics, let's look at a few of the "training areas" that help security teams on their journey to AppSec gold. ## Introducing Snyk's partnership with Gemini Code Assist DevFeed: [Introducing Snyk's partnership with Gemini Code Assist]() Original publisher: [Read original article]() Author: David Lugo Published: 2024-04-09T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI-assisted coding](), [code security](), [ai security](), [Large Language Model](), [Google](), [Google Cloud Platform (GCP)]() Tags: [ai](), [ai-assisted-coding](), [ai-security](), [awareness](), [blog](), [devops](), [enablement](), [executive](), [gemini](), [google](), [interest](), [megawatt](), [partnership](), [related-content](), [security](), [snyk](), [snyk-apprisk](), [snyk-platform]() ### AI overview Snyk announces a partnership with Google Gemini Code Assist to help developers use AI-assisted coding while maintaining code security. The integration provides automated fixes, inline security feedback, and security visibility within Google Cloud Code IDE workflows. ### Source excerpt Learn how Snyk's new partnership with Gemini Code Assist empowers developers to develop with security and AI-powered velocity. ## GitGuardian pioneers secure code solutions down to its source with Chainguard Images DevFeed: [GitGuardian pioneers secure code solutions down to its source with Chainguard Images]() Original publisher: [Read original article]() Published: 2024-03-13T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Security](), [Vulnerabilities](), [vulnerability management](), [code security](), [Containers]() Tags: [chainguard](), [chainguard-images](), [code-security](), [common-vulnerabilities-and-exposures](), [compliance](), [containers](), [customer-trust](), [gitguardian](), [security](), [vulnerability-management]() ### AI overview This case study describes how GitGuardian partnered with Chainguard and adopted Chainguard Images to address software-container vulnerabilities, reduce CVEs, streamline vulnerability management, and meet customer SLAs and compliance requirements. ### Source excerpt GitGuardian partners with Chainguard, utilizing Chainguard Images to reduce CVEs, enhance security, and meet compliance standards efficiently. ## 5 security best practices for adopting generative AI code assistants like GitHub Copilot DevFeed: [5 security best practices for adopting generative AI code assistants like GitHub Copilot]() Original publisher: [Read original article]() Author: Liqian Lim (林利蒨) Published: 2024-03-05T12:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Generative AI](), [AI-assisted coding](), [GitHub Copilot](), [code security](), [Code](), [snyk]() Tags: [acquisition](), [ai](), [blog](), [code-completion](), [code-reviews](), [code-security](), [developer](), [errors](), [generative-ai](), [github-copilot](), [pmm](), [security-best-practices](), [security-tools](), [snyk](), [snyk-code](), [validation]() ### AI overview This article presents five security best practices for adopting generative AI code assistants such as GitHub Copilot. It emphasizes keeping humans in the loop, validating and reviewing AI-generated code, educating teams about risks, and using security tools and guardrails. ### Source excerpt Learn how you can safely adopt AI code completion tools (like Copilot) by applying these 5 best practices and see how Snyk can make it easy to stay secure. ## How to choose a security tool for your AI-generated code DevFeed: [How to choose a security tool for your AI-generated code]() Original publisher: [Read original article]() Author: Liqian Lim (林利蒨) Published: 2024-01-09T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [code security](), [snyk-code](), [snyk](), [ai-coding](), [Generative AI](), [real-time]() Tags: [acquisition](), [ai](), [ai-code-security](), [blog](), [code-security](), [developer](), [guide](), [ide](), [learn](), [pmm](), [real-time](), [security](), [snyk](), [snyk-code]() ### AI overview This buyer's guide presents five considerations for choosing a security tool for AI-generated code. It emphasizes real-time analysis within the IDE, minimal disruption to developer workflows, speed that keeps pace with AI coding tools, and accuracy that helps address generative AI hallucinations. The article uses Snyk's experience and Snyk Code, powered by DeepCode AI, as examples. ### Source excerpt There are a multitude of considerations when it comes to picking the right security companion for your preferred generative AI tool. Here are the top 5 factors for you to consider when making your selections. ## Snyk highlights AWS re:Invent 2023 DevFeed: [Snyk highlights AWS re:Invent 2023]() Original publisher: [Read original article]() Author: David Lugo Published: 2023-12-14T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Generative AI](), [Securing AI](), [Amazon Web Services](), [ai security](), [code security](), [Application Security](), [Application Development](), [Language models](), [cloud security](), [Infrastructure as code](), [Containers](), [sdlc]() Tags: [acquisition](), [ai](), [ai-code-security](), [ai-coding](), [ai-security](), [ai-tools](), [amazon](), [application-development](), [aspm](), [awareness](), [aws](), [blog](), [cloud](), [cloud-computing](), [code](), [code-security](), [coding](), [container-security](), [containers](), [devops](), [executive](), [generative-ai](), [iac-security](), [interest](), [megawatt](), [related-content](), [sdlc](), [security](), [security-solutions](), [snyk](), [snyk-apprisk](), [snyk-container](), [snyk-iac](), [tool]() ### AI overview This recap covers Snyk's AWS re:Invent 2023 highlights, including AWS partnership achievements, new AWS integrations, generative AI developments, and the use of AI coding assistants. It emphasizes the need for AI security solutions because AI-generated code can increase vulnerabilities. ### Source excerpt In this blog, we recap the most exciting developments from AWS re:Invent 2023, including Snyk's industry-leading progress with generative AI, ASPM, and the importance of AI security. ## Using Heartbleed as a starting point DevFeed: [Using Heartbleed as a starting point]() Original publisher: [Read original article]() Published: 2014-04-10T09:06:18Z Content type: opinion Language: en Sources: [Antirez]() Topics: [openssl](), [Security](), [code security](), [Static code analysis](), [C]() Tags: [c](), [code-analysis](), [code-security](), [open-source](), [openssl](), [security]() ### AI overview The article uses the Heartbleed vulnerability in OpenSSL as a starting point for discussing how to improve system software security. It argues for greater investment in security audits, open-source software development, and static and dynamic checks, while noting that changing languages or specifications is unlikely in the near term. ### Source excerpt The strong reactions about the recent OpenSSL bug are understandable: it is not fun when suddenly all the internet needs to be patched. Moreover for me personally how trivial the bug is, is disturbing. I don't want to point the finger to the OpenSSL developers, but you just usually think at those class of issues as a bit more subtle, in the case of a software like OpenSSL. Usually you fail to do sanity checks *correctly*, as opposed to this bug where there is a total *lack* of bound checks in the memcpy() call. However sometimes in the morning I read the code I wrote the night before and I'm deeply embarrassed. Programmers sometimes fail, I for sure do often, so my guess is that what is needed is a different process, and not a different OpenSSL team. There is who proposes a different language safer than C, and who proposes that the specification is broken because it is too complex. Probably there is some truth in both arguments, however it is unlikely that we move to a different specification or system language soon, so the real question is, what we can do now to improve system software security? 1) Throw money at it. Making system code safer is simple if there are investments. If different companies hire security experts to do code auditings in the OpenSSL code base, what happens is that the probability of discovering a bug like heartbleed is greater. I've seen very complex bugs that are triggered by a set of non-trivial conditions being discovered by serious code auditing efforts. A memcpy() without bound checks is something that if you analyze the code security-wise, will stand out in the first read. And guess how heartbleed was discovered? Via security auditings performed at Google. Probably the time to consider open source something that mostly we take from is over. Many companies should follow the example of Google and other companies, using workforce for OSS software development and security. 2) Static and dynamic checks. Static code analysis is, as a side ef