Advertising aside, this makes some good points about general adoption of technology in large teams. It needs to be the path of least resistance or it won't happ

Advertising aside, this makes some good points about general adoption of technology in large teams. It needs to be the path of least resistance or it won't happen. Whether that "resistance" is red-squiggly lines in your editor, CI failures, code-review comments, or being told off by your boss for not following company policy, there needs to be some form of control. From what I've read of Google's software development process they're pretty great at this. Editors warn about a lot of specific stuff (and adding more there is easy), automated code review bots point out issues (and again, adding more of these is easy enough), code-review has strict standards and a process to become a qualified reviewer, generated tests catch incorrect new uses of APIs, etc. In my experience, teams don't invest in this sort of tooling enough, which means that rolling out changes like "let's not use memcpy" or "let's move to Python 3" become much harder, and this certainly impacts security.