This is a valid point. Both the source code and the CFG can hide bugs pretty easily. I would argue that reading source code is much easier, though. For example

This is a valid point. Both the source code and the CFG can hide bugs pretty easily. I would argue that reading source code is much easier, though. For example, if you are auditing code written in a memory-safe language, you don't need to look for memory corruption bugs. You also have an audit trail for all source code changes.