Security is tricky because correct programs (including in C) can have security problems, like side channel attacks and whatnot. You can write code which you th

Security is tricky because correct programs (including in C) can have security problems, like side channel attacks and whatnot. You can write code which you think erases some security-sensitive information to zero bits after a calcualtion, but the compiler throws it away. The program is perfectly safe in that it doesn't crash on any bad input or miscalculate on any good input, but doesn't meet a security requirement. The crux is that what the language standard calls "observable behavior", and behavior that can actually be observed (with security implications) are two different things.