This is the first time I’ve seen “a web app” used as a shining beacon of stability. In short, you can’t test a negative. It’s easy to test “when the car receiv

This is the first time I’ve seen “a web app” used as a shining beacon of stability. In short, you can’t test a negative. It’s easy to test “when the car receives a transmission in X format, Y happens”, but not “there does not exist a transmission format X such that when the car receives it, Y happens”. Memory safe languages can help here, as would fuzzing. But the only true test would be a formal verification, which is a real pain (and even then you’re only testing against a single Y). What you really want is “there does not exist any transmission that could result in any bad behavior”, which can only really be tested in that large scale fuzzer we call Production.