&gt;  <i>Almost every &quot;rule&quot; SEI CERT has for Java either applies directly to C, or is mooted by C&#x27;s fundamental insecurity.</i><p>Did you read the article? That is precisely what it says:<p>&gt; <i>The preceding analysis demonstrates that all of the high-severity Java rules also apply to C code, except for those in Java&#x27;s biggest category, which is internal privilege escalation (IPE). C has no possibility of IPE because C lacks an internal privilege model. We also note that C&#x27;s biggest security category is memory corruption, which does not affect Java code.</i><p>The article ends with:<p>&gt; <i>If you are writing unprivileged code, therefore, you have many fewer rules to worry about in Java than you do in C. Consequently, this table strongly hints that Java is more secure than C. In fact, as we showed earlier, all nine of the remaining high-severity Java rules also apply to C, which provides more rigorous support for our hypothesis.</i>