Code review used to be the only way to catch these bugs

Unit 42's NOVA automated analysis found 14,090 confirmed vulnerabilities across ~3,915 open-source projects, with the majority being logic and access-control style flaws (not memory crashes). The study revealed large supply-chain exposure (5,421 findings; ~4,141 downstream exposures), 2,776 validated exploitability proofs of concept, and warns that faster automated discovery plus rapid patching can make producing exploits from patches easier; Unit 42 is working with maintainers but has not published affected project names or CVEs.