gistfile1.txt

If CVEs in C++ code were 98% lower (2% of today) in the four key buckets -- initialization safety, type safety, bounds safety, and lifetime safety -- then we wouldn't be having this conversation. There would be no problem.

Cpp2 today has

guaranteed initialization safety (better than C# or Java),

guaranteed type safety (via safe is type queries and as casts),

bounds safety (via subscript checking, banning pointer arithmetic, and safe-by-construction iteration such as range-for) except for naked use of raw STL iterators, and

I still need to implement in cppfront the C++ Core Guidelines Lifetime safety static analysis (which I designed for Cpp2).