Most security bugs are due to improper string validation and use.