you can't "just have a really good test suite" your way out of this. security issues are caused by violation of properties you never even thought of, by non-obvious and often indirect interactions of things nobody realised were connected. your tests will not catch this