>> Vulnerabilities happen from wrong function calls, yes, but also through using the wrong types of calls for the particular purpose. > Which is detectable thr

>> Vulnerabilities happen from wrong function calls, yes, but also through using the wrong types of calls for the particular purpose. > Which is detectable through static analysis of the type signatures -- at least to the point of ensuring that a threat assessment document includes a section on what they did there. I don't think you read prior to replying. Type signatures are orthogonal to the purpose of code. Just because a call is made to XTS don't convey that disk encryption is used. That is the issue that you glossed over. An IDE only has enough information to threat model an application correctly if it had enough information to write the application in the first place.