"All the right things" included, according to the actual narrative in the post: - Extensive non-fuzzing testing. - Regular static analysis. - Being actively

"All the right things" included, according to the actual narrative in the post: - Extensive non-fuzzing testing. - Regular static analysis. - Being actively maintained and overseen by a competent security team, with a bug bounty program on top. I believe I've also seen mentions of independent security audits outside the post. Edit: emphasis is on the fuzzing, because that is how the bug was finally discovered.