&quot;I have never professionally audited a C project and not found a vulnerability.&quot;<p>Just out of interest: How many C projects have you audited? And have you ever looked for a relationship between the number of vulnerabilities and the percentage code coverage from automated tests?