Short answer: you don't, you brute force testing with your user base and you get lucky until you don't, plus you don't care because you're too entrenched. That

Short answer: you don't, you brute force testing with your user base and you get lucky until you don't, plus you don't care because you're too entrenched. That's how 99% of these old timey tools work (coreutils, SSH, SSL, etc). They're getting better but you can definitely feel that they're managed by old hackers that predate CI/CD.