[tptacek]

You can't just audit the code. You have to audit the whole runtime, every time the app touches the web server. It's not a tractable problem.