OpenBSD has done a great job, especially if you look at what they achieved, how fast they got there, and what resources were at their disposal.
Qmails direct competitor Postfix? Postfix has more, but Qmail has one with a higher score:
https://www.cvedetails.com/vulnerability-list/vendor_id-8450... vs https://www.cvedetails.com/vulnerability-list/vendor_id-86/p...
Postfix is also much more widely used than qmail.
Re:Some obscure C features
by littlestymaar on Thursday January 25, 2018 @09:11PM
(#16236529)
Even djb had flaws in his C code despite being a semi-god. It took a $10k bounty and several years to be found but it was there !
If that's true, how come there are almost no widely used network facing C programs that didn't have plenty of security vulnerabilities?
(Anything written by Daniel J. Bernstein doesn't count, because there's no way he's a mere mortal. :))