There are two separate issues. One is how prone to security flaws the language itself is. The second is if there are library routines that introduce flaws.<p>This study is highly dependent on the exact code base analyzed, and especially on the quality of the analysis tools with regard to false positive rate.<p>I suspect this is largely GIGO but will try to take a deeper look at it at some point.