a particular product.
If a vulnerability discovery seems to match all five criteria, then it is highly suggestive of
the developer’s lack of security awareness (items 1 and 2) combined with a lack of
security testing (items 3, 4, and 5). A vulnerability might be more “forgivable” if it does