qualitylab

Adversarial exposure · Determinism

Write new code in a memory-safe language

tier II/cost to adopt: high/active

The share of vulnerabilities caused by memory unsafety tracks the language new code is written in, not the language the codebase is written in — one platform went from 76% of vulnerabilities being memory-safety issues in 2019 to 24% in 2024 while the bulk of its code remained unsafe.

Do this firstNothing. This is a place to start.

Leave the old code alone. Write the new code somewhere else.

Two independent organisations put memory unsafety at about 70% of their serious vulnerabilities — one across CVEs fixed by security update over more than a decade, the other across 912 high and critical bugs. That is the baseline this control moves.

What makes it adoptable is the third measurement. The platform that changed its number did not rewrite anything: it changed what new code was written in, and the annual count of memory-safety vulnerabilities fell from 223 to 85 over three years. The mechanism is that vulnerabilities concentrate in new code, so the language of new code sets the rate even while the old code sits there.

Their own word is “correlate”, not cause, and the honest reading is that the confound — teams adopting a new language are also teams doing other things — has not been ruled out.

The decoy

Rewriting the old code. It is the version of this everyone imagines, it is usually infeasible, and it is not what produced the measured result — the codebase that halved its vulnerability rate is still majority memory-unsafe.

Evidence

Last reviewed 2026-08-19.