What are we doing here?

Does it benefit anyone?

Do we have a moral conscience/responsibility to think and act about these things (or do the best we can with the time we allocate to helping programmers in distress)?

Before we start I have a 7,500+ rep on Stack Overflow, jon-goodwin. I expect you to express your opinions and views/values since the tags are & ! I must admit the change in mindset required from Stack Overflow main site to the meta.stackexchange.com was a strain on my brain and nerves but I think I'm getting the hang of it.

Enter image description here

Stack Overflow made the BBC news:

Lazy developers who copy solutions to tricky programming problems are creating apps that are vulnerable to attack, research suggests.

A team of computer scientists looked at more than 72,000 chunks of code found on the Stack Overflow website.


But researchers found many of the most copied snippets lacked basic checks that would stop common attacks.

The dangerous code chunks often used obsolete functions, did little to check user responses and did not look for attempts to break the application, said the study.


The paper

An Empirical Study of C++ Vulnerabilities in Crowd-Sourced Code Examples

Morteza Verdi, Ashkan Sami, Jafar Akhondali, Foutse Khomh, Gias Uddin, Alireza Karami Motlagh (Submitted on 3 Oct 2019)

Software developers share programming solutions in Q&A sites like Stack Overflow.

The reuse of crowd-sourced code snippets can facilitate rapid prototyping. However, recent research shows that the shared code snippets may be of low quality and can even contain vulnerabilities.

This paper aims to understand the nature and the prevalence of security vulnerabilities in crowd-sourced code examples.

To achieve this goal, we investigate security vulnerabilities in the C++ code snippets shared on Stack Overflow over a period of 10 years.

In collaborative sessions involving multiple human coders, we manually assessed each code snippet for security vulnerabilities following CWE (Common Weakness Enumeration) guidelines.

From the 72,483 reviewed code snippets used in at least one project hosted on GitHub, we found a total of 69 vulnerable code snippets categorized into 29 types. Many of the investigated code snippets are still not corrected on Stack Overflow. The 69 vulnerable code snippets found in Stack Overflow were reused in a total of 2859 GitHub projects. To help improve the quality of code snippets shared on Stack Overflow, we developed a browser extension that allow Stack Overflow users to check for vulnerabilities in code snippets when they upload them on the platform.

I find interesting:

Prof Sami said the team had developed an extension for the Chrome browser that checks when code is copied from Stack Overflow and lets coders know if it is poorly written or insecure.

The most widely used insecure code blocks turned up in more than 2,800 separate projects on the Github website, they found.

See also:

Questions on Meta Stack Exchange should relate to features or policies that commonly apply to the network or the software that drives it.

  • 46
    My dad actually asked me the other day if I'd "heard about Stack Overflow", and I immediately assumed he was talking about the Monica situation and began a clumsy explanation of it, but it turned out he was actually talking about this article.
    – F1Krazy
    Commented Oct 9, 2019 at 13:06
  • 67
    <quietly removes "found on Stack Overflow" comments from code-base>
    – user351483
    Commented Oct 9, 2019 at 13:07
  • 9
    ;O) First time I saw StackOverflow on the BBC news, and I'm a C++ programmer...oh dear Commented Oct 9, 2019 at 13:08
  • 10
    No mention of SO still being riddled with code vulnerable to SQL injection, especially when using questions as an example.
    – Erik A
    Commented Oct 9, 2019 at 13:14
  • 14
    New drama. New crisis. It's too much for me. Commented Oct 9, 2019 at 13:22
  • 66
    It's not like any of this would come as a surprise to anyone. The code on Stack Overflow is often expressly not written with security considerations in mind, because more often than not, security is something that requires adaptions to the code that are not standardized across the programming community. Of course there is issues like using obsolete APIs in old answers and of course having these old answers out there does nothing to clean up the incorrect usage of said old APIs... Commented Oct 9, 2019 at 13:25
  • 12
    Did the research team edited problematic posts?
    – aloisdg
    Commented Oct 9, 2019 at 13:27
  • 76
    People copying code they don't understand leads to bad code. I suspect its a problem with how coders are taught, not SO Commented Oct 9, 2019 at 13:28
  • 6
    @JonGoodwin Surely you can't have missed this one!? :p Commented Oct 9, 2019 at 13:40
  • 13
    When you post a code example on SO, it's just that, an example. You're explaining a particular aspect of a programming problem and leaving out anything that isn't important for the answer, not writing a complete solution that's ready to ship. Anyone who treats code examples as such is being lazy or stupid or both.
    – user621031
    Commented Oct 9, 2019 at 14:04
  • 6
    Copied it from Stack Overflow comic.
    – PM 2Ring
    Commented Oct 9, 2019 at 14:08
  • 44
    "Some 40% said the code was safe because users could not change it once an app was running." - lol, what? The computer-illiteracy on display from the BBC here is a tad embarrassing. Looking at the study, what they mean is that 40% of issues were closed without a fix on the basis that the theoretical vulnerability in the copied code snippet did not apply to the particular project the issue was raised on because the code snippet was never passed dynamic inputs.
    – Mark Amery
    Commented Oct 9, 2019 at 14:09
  • 8
    @ErikA Also not to mention answer writers that respond with hostility when you try to inform them that their code contains a SQL injection vulnerability. :(
    – PM 2Ring
    Commented Oct 9, 2019 at 14:11
  • 10
    @Snow beware of removing "found on Stack Overflow" comments. You might be breaching the CC-BY-SA-%.1f license by omitting attribution. Commented Oct 9, 2019 at 15:50
  • 12
    BREAKING NEWS: Untrustworthy sources of information was found on the Internet! BBC is broadcasting live from Turbo C, where some mighty fishy JavaScript is being written.
    – Lundin
    Commented Oct 10, 2019 at 9:19

11 Answers 11


Security is something that requires an architectural, holistic view.

If someone asks how to frobnicate a row in a database, we will show them how to frobnicate a row in a database and nothing more than that. If they have not secured the database (i.e.: guaranteed that only some users can frobnicate it, or made sure that scripts can't be foo'ed into it), that is another problem.

And the thing is... if we are to show them how to secure code, it's going to make answers much longer and less to the point. In some cases we might have to write the whole code the OP needs. That is not the purpose of Stack Overflow.

A good analogy would be this: if someone asks on diy.se how to splice an electric cable, and we show them, and they end up dying because they were working on a live wire, it's their fault for being a Darwin Awards contestant, not ours for not giving them a full course on how electricity works.

  • 20
    Like the frobnicate, new one on me ! The word “frobnicate” in IT is a kind of techie slang that describes tweaking or fiddling with physical parts of a technology. Frobnicate has been regularly abbreviated as “frob” or related to a piece of hardware architecture called a “frobnitz.” Commented Oct 9, 2019 at 13:56
  • 4
    Even so, adding "needless to say, you shouldn't do this on a live wire without precautions" is optional but courteous, and you get to appreciate the irony of having to say something that's needless to say. I've posted my share of programming answers richly slathered in "and of course, despite this answering your question it's a massively terribly idea and shouldn't be done this particular way" while imagining some poor schmuck going "neat!" and yoinking the code directly into their nuclear reactor system software. Sometimes the warm glow you feel is actually radiation -- we do our best. Commented Oct 11, 2019 at 12:18
  • 1
    @JeroenMostert I have done the same, and with the same feelings. Sometimes it's easy (i.e.: by the way use parameters so as to avoid SQL injection). Sometimes, though, the problem is systemic. Commented Oct 11, 2019 at 13:49
  • @Jon Code formatting is not a form of emphasis and you added a link to a completely wrong site (intended was diy.stackexchange.com).
    – grg
    Commented Oct 15, 2019 at 16:41

Is this an attack on Stack Overflow?

No, it isn't. You could substitute any crowd-sourced programming site for Stack Overflow in those articles, and only the numbers would change: code snippets from other sites will be found less often on GitHub, but I suspect the relative amount of vulnerable snippets is roughly the same.

If anything, this is an attack on the attitude of modern software developers. Knowing how to copy/paste does not make one a software developer; you need to know why and how the code snippet is helping to solve your problem. I can't even blame these poor souls: there's such a high demand for software developers right now that even people less suited for such tasks apply for those positions, even though they have other talents which would be much more appreciated in other kind of jobs.

  • 15
    What’s funny is that the companies scouring the market for cyber security experts to protect their systems are often the same ones that won’t allow the extra cost of a proper security architect and processes/controls in their SDLC.
    – ColleenV
    Commented Oct 9, 2019 at 14:13
  • 5
    @Glorfindel I take issue with "You could substitute any crowd-sourced programming site for Stack Overflow". NO YOU CANNOT StackOverflow is clearly the best ! Commented Oct 9, 2019 at 14:45
  • 2
    even though they have other talents which would be much more appreciated in other kind of jobs, if there are 400 applicants to be a forest ranger, I don't blame a moderately talented forest ranger to apply for jobs other than where their talents best fit.
    – gerrit
    Commented Oct 9, 2019 at 17:00
  • 3
    @JonGoodwin The community is. If the community move and contribute somewhere else. SO will face trouble.
    – aloisdg
    Commented Oct 10, 2019 at 6:37
  • 1
    I'd add that the hyper-modern software development patterns will even sometimes look with suspicion on people who are able to craft their own code because it's not 'the patterns I'm used to/what I found with a Google search'. There is a growing attitude that consistency means: copy and pasting regardless of context. It's not good. Commented Oct 11, 2019 at 20:48
  • 2
    @JonGoodwin Since there is no downvote button, signify this comment as a -1 on your comment. There is nothing rude about it. He is simply stating his opinion. Commented Oct 12, 2019 at 16:19
  • 3
    @JonGoodwin Your question is fine, it's your comment I have a problem with. Commented Oct 12, 2019 at 16:42

Is this an attack on Stack Overflow?

No, this is non-news.

"The people who are using Stack Overflow, they shouldn't trust it fully," said Prof Ashkan Sami [...]

This advice should be extended to the Internet as a whole.

"It's better for programmers to do it the hard way and learn secure coding," he told The Register tech news site.

Sadly, when we get questions in where the OP is using outdated/insecure code and we try to correct them, we get told that we're derailing the question and we shouldn't focus on that.

Damned if you do, damned if you don't.

Prof Sami said the team had developed an extension for the Chrome browser that checks when code is copied from Stack Overflow and lets coders know if it is poorly written or insecure.

This on the other hand is quite neat.

  • 11
    We see the same thing in Python. The answer fixes some minor bug in the OP's code but doesn't even mention the blatant SQL injection vulnerability in it. And when you point out that vulnerability the answerer angrily exclaims "But the OP never asked about that!" :facepalm:
    – PM 2Ring
    Commented Oct 9, 2019 at 14:19
  • 8
    Prof Sami said the team had developed an extension for the Chrome browser that checks when code is copied from Stack Overflow and lets coders know if it is poorly written or insecure. I expect that's some half-baked static code analysis tool, you're probably way better off using an actual code analysis tool than some Chrome plugin that only operates on SO snippets.
    – Erik A
    Commented Oct 9, 2019 at 14:29
  • 4
    @ErikA I wouldn't use that extension. I have no interest in it as I like to understand the code that I come across before I decide if I'll use it.
    – Script47
    Commented Oct 9, 2019 at 14:31
  • 4
    that tool just says var codeProbablyBad = url.contains('stackoverflow')
    – user148287
    Commented Oct 9, 2019 at 17:00
  • 4
    "This advice should be extended to the Internet as a whole" absolutely!
    – pacmaninbw
    Commented Oct 9, 2019 at 17:11
  • @PM2Ring Write a 2 part answer: 1st how to fix your original problem 2nd where to go from here (security, refacto, etc.)
    – aloisdg
    Commented Oct 10, 2019 at 6:39
  • 1
    @aloisdg Yes, I tend to do that, separating the sections using <hr>. Of course, we aren't obliged to fix every little thing in the OP's code, just the question they explicitly ask. But we should try to steer them towards best practice. And if we do see downright dangerous things in their code we are obligated to mention them; we certainly should not blindly copy & paste them into the code of our answer!
    – PM 2Ring
    Commented Oct 10, 2019 at 8:02
  • @PM2Ring not blindly copy & paste ofc. try to steer them towards best practice we do (at least around the .NET and Git tag). It can be my own perception though. I think the best thing to do would be to use SO for bugfix and quick refacto/tips on the mcve, but any deep improvement should be made as its own post on codereview.
    – aloisdg
    Commented Oct 10, 2019 at 8:30
  • @aloisdg Ideally, OPs post a MCVE on SO; of course on CodeReview they must post a complete working program. But in reality, they don't post minimal code, so things can get messy.
    – PM 2Ring
    Commented Oct 10, 2019 at 8:50
  • 1
    @PM2Ring you want to enforce something? Enforce MCVE. Dont allow to post a code without a MCVE. The quality of the MCVE will vary, but even a bad one will help everybody a lot. (Also use cases and test cases with expected input/output please)
    – aloisdg
    Commented Oct 10, 2019 at 9:11
  • "This on the other hand is quite neat." I'm sceptical about automated tools that do things like this as they often cough Sonarcloud cough mix important coding principals with absurd personal preference and can force coding decisions that may well be non-optimal. Rigid rules have their place and that's what those kinds of tools tend to enforce, but it's important to be wary that they can restrict talented practioners from fully doing their jobs. Commented Oct 11, 2019 at 20:53
  • No, this is non-news. Well yes it is news (by definition), maybe not to you or most people but, yes it is news . "yesterdays new is tomorrow's fish and chip paper" Commented Oct 12, 2019 at 11:36
  • 1
    @JonGoodwin Right or wrong, it's a common idiom in English to refer to items of news that are, in fact, totally devoid of substance in the sense of information that was not already held by pretty much everybody, as "non-news" :) Commented Nov 27, 2019 at 14:38

It's not an attack or condemnation of Stack Overflow. When new tools that give individuals amazing powers enter a market, folks tend to get a little tipsy on them. Just look what we did with jQuery <(I kid, mostly)>. We've established that Stack Overflow (and similar sites) are an essential tool for programmers in this day and age.

If you think about it, that took some work. There was a stigma surrounding asking for interactive help for programming problems, especially in academic settings. Universities put an enormous amount of effort into stopping students from using the site (some still do), but many are coming around to understanding that interactive Q&A is just a natural tool that programmers use and moving forward with that in mind.

So, that's one huge hurdle. The next one is teaching people how to use it safely, effectively, and without repercussion that ends up costing more hours to fix than time saved getting some help.

That's .. something I think we'll all be looking forward to. There's only a few more months left before the next decade rolls in. People are going to build amazing careers out of working on just that alone.

  • 3
    Re "Universities put an enormous amount of effort into stopping students from using the site": Including using obscure programming languages like x86 assembly language (if it can be called a programming language) to cut down the number of potential answerers. One day they may even turn to Forth. Commented Oct 10, 2019 at 0:17
  • I learnt programming 2.5 years before I started at the university. Concerning other first-year students that are completely new to programming, I encourage them to use SO as a source of solutions to whatever they need, but discourage them from asking questions, as I (and the origin of SO) regard SO as a place for professional and enthusiast programmers, with high-quality content, and not a personal beginner tutorial. I therefore appreciate that universities try to keep their students off this site in the beginning. Else we risk them getting off to a (too) rough start, before they're ready. Commented Nov 27, 2019 at 0:43
  • I was one of the people that felt harshly treated when I first started participating at SO. I've later come to like the core values of the community and the original project that SO was. I now understand that I wasn't ready. The reason why I jumped in so early, was a fight between my personal needs, and the front page directly in opposition to "a website for professional and enthusiast programmers". I saw terrible questions get upvotes and answers. I joined in under the Python tag. I didn't meet the expectations, and didn't understand the difference between posting under the different tags. Commented Nov 27, 2019 at 0:48
  • - so I got off to a rough start. I'm not so sure that universities oppose Q&A. Maybe it's just that they want to postpone the introduction as an active contributor to SO, for their students? Commented Nov 27, 2019 at 0:51

This is hardly news.

Just like people now have super-easy access to their friends' opinions (and vice versa) and Facebook (along with other social media platforms), instead of having to actually read the news or have a proper conversation with people… you can post your assignment on Stack Overflow and get a poorly-constructed, non-production-ready snippet in seconds.

The same thought process (read: not much of one) that led to your decision to post the question in the first place, also leads to you copy/pasting the code into your editor and away you go. There's no reasoning, no experimentation, no analysis. No drive to be better. It's too easy not to be.

Unfortunately, just as social media is having a real-world toll (see: the mental health of children, the spread of fake news, general polarization of society), the removal of this "thinking about it" barrier to entry for programming doesn't only apply to kids at school, but also to people who are allegedly actually producing software that we use every day. People who "can't do their job without Stack Overflow" (!!!) because it's "an essential tool in this day and age" (???). Of course that software is going to be riddled with holes as a result.

It's the world we live in now. Convenience has a cost, and this is it.

We did try to put a pin in it, by limiting questions to useful, thought-provoking content rather than having the site just be a code generator for the lazy. But that ship sailed long, long ago.


The paper's statement of

The site is popular with developers seeking advice on the best way to fix broken code.

is misleading. Although this is true, there are also many developers asking questions on Stack Overflow for help to solve general programming issues when writing new code. Using this statement, along with results from checking all of the Stack Overflow questions & answers, even those not related to fixing existing code (although in many specific cases this would not be clear), can give a distorted picture of the situation.

Stack Overflow is a Q&A site which provides answers to specific problems. Just as it's not appropriate to ask questions which are too broad or not well defined, answers should generally be focused on solving the specific question asked. It's up to the user to understand what is being provided is usually not production-ready code but, instead, just provides something which explains the solution in computer code rather than in something like pseudo code or English statements. Adding a lot of error checking in the answer can, in many cases, make the answers quite long, so it'll not only unnecessarily slow down the answerers, but also any readers who are reading them later.

Note that Stack Overflow is a teaching tool, just like programming text books and general books. The sample code in those books, from my experience, also often don't usually include a lot (if any) error type checking or handling, with them even mentioning this explicitly in some cases. The sample codes' purpose is to teach a specific concept, so their sample code focuses on just this. However, at least with physical books, users can't easily copy & paste the sample code to use it either exactly as it is, or with only a few modifications, as people can do with any code from Stack Overflow, as well as from other Web sites. I believe it's the responsibility of the programmers doing this to be aware they need to ensure the code they write not only does what they want, but also does it securely. Schools and online courses teaching programming should include the basics on how to write quality, secure code, and perhaps should also explain how to properly use sample code from various sources, e.g., books, Q&A sites, code repositories, other Web sites, etc.


The article is written by someone who lacks knowledge of how to actually produce software. Note that the article has no cited author, so this is largely an assumption, but for the most part the language used makes it clear there is a vast distance of misunderstanding of the way programs work when they connect security risks to not including polyfills.

If I create a piece of code to list the characters remaining in a tweet, and it is off by 1 due to reasons, that is not a security vulnerability. While there may be security vulnerabilities in a very small percent of code, the famed sql injection post comes to mind, those posts (including the sql injection one) are thoroughly debunked on the same page both in comments and answers.

Overall the majority of what you will find is straightforward answers without things like backwards compatibility or "polyfills". That is because they simply don't belong, a responsible developer is expected to include those in their public deployment as is required by their target audience and technology.

The article uses such a lack of polyfill to seemingly indicate that solutions at Stack Overflow are causing vulnerable programs (or apps as the buzz word goes).

The dangerous code chunks often used obsolete functions, did little to check user responses and did not look for attempts to break the application, said the study.

So, someone requests placing an alert from text on the screen. An answer takes some text and displays it on the screen. The answer does not prevent XSS or ill formed structure that causes the display to render funny. Is this a "dangerous code chunk"? No. It is just the most direct way to solve the problem. If there needs to be XSS support, and support for encoding etc. that would be a separate issue; one that you would both expect a developer to understand and incorporate.

I would have expected more from the BBC, although not much more. Since they are a reputable source, they should retract their low quality article. While the cited study was apparently conducted (where exactly is this study published?) by a published Associate Professor, the findings are pulled way out of proportion here.

The study indicates that there can be problems in Stack Overflow code whereby it is out dated or lacks certain error checking, which is true. The article then takes that point and makes the claim that everyone is suddenly at risk of security vulnerabilities. I wonder if there was a hidden agenda here somewhere?

"The people who are using Stack Overflow, they shouldn't trust it fully," said Prof Ashkan Sami, a computer scientist at Shiraz University in Iran who co-wrote the study.

And then, in the very next sentence, the article's author points out that the same critical "Professor" created an extension which luckily saves you from this pitfall. How convenient.

Prof Sami said the team had developed an extension for the Chrome browser that checks when code is copied from Stack Overflow and lets coders know if it is poorly written or insecure.

While it is always true that as a developer you need to ensure the code you use from third party sources is legitimate, the truth that developers should strive to avoid being lazy absolutely should not be used as a bludgeon against Stack Overflow or GitHub.

Going forward, perhaps just don't visit the BBC. I certainly don't due to a history of blunders such as this article.

There is always Reuters, the Associated Press, The Guardian, The Independent, etc. Or whatever your other favorite news sources are for that area of the world.


Sounds bad, right? Yes, but the paper did not look at a number of factors that potentially make this a lot less bad than it sounds.

In my experience there’s usually something that tells you when you should be skeptical of an answer: it’s score, the other answers on the question, and sometimes even the creation date are all potential signals. And the comments are even better than that as many times as they often explicitly mention what’s wrong with the answer.

(If I understood correctly, the paper found some vulnerable answers specifically because comments pointed it out.)

It’s up to the developer to listen for the signals and dig a little deeper, especially if it doesn’t point to a strong yes about the answer being good.

If anything this is an attack on laziness.

It’s also worth thinking about this:

  • Was all the GitHub code actually vulnerable? (Were the 40% correct about their code?)
  • If the code was vulnerable, does it actually matter for the project? (For example, a MOTD doesn’t need perfectly uniform randomness. And code only intended to be used by the author might not need much validation.)

By the way, “13% of the developers contacted”, etc. as mentioned in the news article is incorrect. It’s actually only that percentage of those who responded (=15 people), so 13% is 2 people, 40% is 6 people. Statistically this doesn’t tell us much more than very few people actually responded to them.


Is this an attack on Stack Overflow?

This is just sloppy work facilitated in part by the existence of Stack Overflow. Our network has on average good quality information in the highly upvoted, often visited parts but this study shows that even there not everything is really production ready.

We could warn people more explicitly about that and we could try to improve the existing information, however, the reputation system presently favors original answerers and much less editorial work, while alternative, newer answers even though they may have better momentum are often shown below older, once popular answers.

Therefore this is also an issue with the reputation and scoring system that doesn't work well for maintaining and improving aging content.

  • 2
    I don't know about average good quality information. Perhaps if weighted by upvotes. Commented Oct 10, 2019 at 0:25
  • @PeterMortensen Yes, only weighted by upvotes. Commented Oct 11, 2019 at 8:34

I'd say that to a large extent it's as much a fault of the state of education as much as anything else.

I've never been particularly good at school. When I finally got my degree - I'd had to retake one module, strategic management. Our exam was a case study and I predicted that a major GPS manufacturer would need to give up on standalone devices, and that their maps business had value, and they'd need to find new market segments. Ended up... I was right in reality.Yet I flunked the exam. It was an open book exam and I ... basically just copied my exam paper off the internet (was an open book exam) and got a Credit. I... am not proud of this.

Controversially, I believe not everyone is cut out to be a software engineer. Anyone could be and they need every opportunity to follow their desire to be one. One of the key skills I feel folks need in any field - is love for the subject, intellectual curiosity, and a deep understanding of the fundamentals. The rush to put butts in programmer and even tech seats kinda means folks are thrown into the deep end unprepared.

And yet many folks probably are encouraged to go through life this way - "write this!" but not why. Folks encouraged to just bandaid fix stuff until it works, and yet not document it. Copying code off Stack Overflow isn't just because the code is there - its because there's a culture of crunches and beating stuff into working.

If I hit my thumb with a hammer, I do not blame the hammer. I blame the person holding the hammer. That said, I also shouldn't be working on high voltage or around dangerous machinery without proper training.

Its not 'just' a software engineering problem - I posted a series of answers like this one with an alternate account because folks kept having the strange idea that kali linux makes them a hacker, without basic knowledge of the environment they work in.

So.. maybe SO might have bad code, but I feel the way things are run in the software development community doesn't equip folks to turn that 'bad' code - designed to help people understand an issue or a pattern into good code.

We have a lake. Some people fish. Some people stock the lake. A few people don't know what's the good fish, take whatver they can, and choke on it. We need to teach people not to choke, not tell them to stay away from the lake.


I don't think it's reasonable to consider any single website the bad guy just because people copy code from it. People will always copy code from somewhere, because there are always problems that someone can't really fix on their own, and needs outside help. They can find examples how to fix it on Stack Overflow, online forums, facebook, reddit. Even in programming books, which aren't all high quality. And sometimes the need is urgent enough that a person can't really analyze the code carefully before using it.

  • 1
    I think you have it the other way around. If you are introducing security flaws because of an urgency, you are just adding more urgent things to fix. Commented Oct 9, 2019 at 20:13
  • Yes, but in most cases more urgent things to fix for a developer several years down the line.
    – Alex
    Commented Oct 10, 2019 at 9:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .