I think it really depends upon the codebase. Libraries are easier to test than applications in general, since you have a published API to throw at testing. On

I think it really depends upon the codebase. Libraries are easier to test than applications in general, since you have a published API to throw at testing. One approach (and it seems to work for LuaJIT, a mid-sized C based project) is to just collect test cases as bugs arise (create the smallest input possible to trigger the bug in question) and as changes are made, rerun all those cases as a type of ever-growing regression test. Or, you know, run a fuzzer.