2 ms·

Even if there is no "0 unsafe code" guarantee, it is quite practical since it still reduces the attack surface.