This article is coming at it from entirely the wrong way. Counting rules is not how you assess language security. We already had language security assessments back in the 80&#x27;s-90&#x27;s with proper methodology that taught us more useful stuff. They had basically two approaches: systematic analysis of language attributes on specific types of defects or vulnerabilies; empirical analysis of defect or vulnerability rates on real-world projects with comparisons on languages. The author or another party should apply one or both of those to modern versions of the language to assess real risk. Then, apply analysis of any coding guidelines to see what they counter and what effort is required as productivity is important criteria.<p>On the other hand, this analysis tells us about nothing useful except that there&#x27;s rules, the rules have claimed benefits, rules here vs there, and a recommendation based on that. Ignores too many real-world concerns. Waste of time.