A development team can follow safe coding practices, maintain their dependencies current, and yet ship a vulnerability that nobody realizes. The real attackers don’t have