you shouldn't be waiting for your users to tell you where your security holes are. while I agree with that ideology, in reality you just can't assume that to b

you shouldn't be waiting for your users to tell you where your security holes are. while I agree with that ideology, in reality you just can't assume that to be the case when you have multiple people touching the code, and features added regularly that may inadvertently introduce holes. what software has ever been 100% bullet proof? Also, I think that statement largely contradicts the notion of 'release early, iterate often' considering it's grounded on the notion of integrating feedback and bugs reported by users. Are major corporations held at a different standard simply because they have more resources? Even with thousands of employees, it's still a glass box compared to the millions that will use it.