“The safest thing is to do nothing” is a great cliche, but in the case of software security, this is almost never the case. Starting with the very first line of code we write, the line has been crossed—we have introduced security risk that needs to be managed.