> trusting a URL which you shouldn't trust That's actually a feature in Ur/Web, which is a (very niche) language explicitly built for making web servers. It's

> trusting a URL which you shouldn't trust That's actually a feature in Ur/Web, which is a (very niche) language explicitly built for making web servers. It's sort of a domain-specific language though, so maybe it doesn't count. > making a function public when it should be private Nothing's gonna stop a programming mistake like that, but in languages with capabilities[0] you can restrict some functions to only be called when you have certain capabilities, and these capabilities can only be made to be acquired after authenticating a user, for example. [0]: https://borretti.me/article/introducing-austral#cap https://borretti.me/article/introducing-austral#cap