On the server that was heartbleed under the WebMEM spec. There needs to be a tight feedback loop between the feature people and the security people. Without it, the FP will over-run the SP. The default to ship, ship in public attitude means that all of these "features" get public exposure before the security people have looked at it deeply. Much of the worlds technical architecture needs to get inverted.