This "encode problems into names" approach is something I first ran into at Facebook. When a particular function or class is found to be a problem (or when it

This "encode problems into names" approach is something I first ran into at Facebook. When a particular function or class is found to be a problem (or when it is known to be a problem in advance), it is (re)named something like "foo_POTENTIAL_XSS_HOLE" or "FooMapNonStlCompliant" throughout the code base (using pfff or similar tool), and then the potentially long process of removing the problem can go forward with some confidence nobody will add to the problem while you're working on it. pfff: https://github.com/facebook/pfff https://github.com/facebook/pfff