Admittedly, SQLite has to do a lot less than Postgres, but I'll throw their hat in the ring if only for the rigor with which they test their code-base[1]. My visceral, completely irrational original gut reaction to that page was "meh, they're likely just generating the set of all permutations where on likely-injectable strings-- no formal verification, no care".

Thankfully, I went for a coffee, came back and the tab was still open for a more complete read. I've worked on tons of projects in my career -- from healthcare to finance, large insurance companies and defense. I really think SQLite is definitive case study on how to test your code-base in a "meaningful" (where "meaningless" would be generating the aforementioned permutations) manner. As new methods of testing emerge, they expand the scope of their coverage as well (i.e., AFL and other fuzzing techniques which emerged circa 2014).

Hats off to their team for the discipline. If I ever need someone to manage taking a pacemaker to production, I'd hire whoever was in charge of their testing, give them access to Fidelity Payroll, hand them the p-card, and tell them "whatever you need, it's yours, buddy".

[1] https://sqlite.org/testing.html