The first thing to fix is bad tooling, yes, but it&#x27;s not the whole picture.<p>Once all your queries are safe by default, your languages have memory safety, your templates XSS-encode by default etc etc (this is basically the situation at most sane workplaces) - there are still security issues.<p>There are <i>fewer</i> security issues left, but they&#x27;re gnarlier. What we see now are &quot;application logic&quot; and business logic issues. Overflow and language-level sharp edges exist, but these are a small proportion of the mistakes developers (in particular, web application) seem to be making.<p>Situations where the server unintentionally signs user-controlled data, bad OAuth2 flows, missing or incorrect authorisation checks, accepting data from the client as &quot;validated&quot; - these are much more common in my experience.<p>The other interesting thing I&#x27;ve noticed is that when developers who are used to &quot;safe by default&quot; frameworks have to step outside the framework for any reason (e.g. front-end is 90% angular, but 10% &quot;bespoke&quot; JS) they will make mistakes with very high likelihood.<p>The solution is tooling yes, but also education and process.