Neither did the people writing it, or merging it. Security isn&#x27;t an obvious property of code or there would be no security bugs. You have to rely on heuristics, and in this case the heuristics were right.