"I have never professionally audited a C project and not found a vulnerability."

Just out of interest: How many C projects have you audited? And have you ever looked for a relationship between the number of vulnerabilities and the percentage code coverage from automated tests?