At least, it requires someone to be able to act in mitigation. That might also be the user of the software (if they can patch it, find a workaround, have some o

At least, it requires someone to be able to act in mitigation. That might also be the user of the software (if they can patch it, find a workaround, have some other software validate inputs or detect attacks, etc.).