Has there been any study of the effectiveness of code audits? Sensitivity and specificity in trying to find security problems, unintentional or intentional.
In real life however we have to accept imperfections, in which good-enough is often better than not at all