There are many ideas to make this workable. How about this: Did you test your code for buffer overflows? If not, you're negligent. Maybe you need to submit an

There are many ideas to make this workable. How about this: Did you test your code for buffer overflows? If not, you're negligent. Maybe you need to submit an affidavit that the code has ben tested, a log from an outside testing service (similar to a building inspector, but for code quality), or some other step to verify that something has been done. For the record, building inspections have flaws, too, but they sure help in spite of those issues! Many other ideas, but that one is simple to communicate.