I would add: - Add security measures provided by your compiler to your builds: -fstack-protector-strong on GCC. -fsanitize=safestack on Clang if you have a ver

I would add: - Add security measures provided by your compiler to your builds: -fstack-protector-strong on GCC. -fsanitize=safestack on Clang if you have a version that's new enough. - Build the program with AddressSanitizer and run it with typical data. Run it through a fuzzer afterwards.