open source did not stop Heartbleed. How about force commercial software companies to have 1 in 10 devs. dedicated to security with even a single feature ticket getting fixed by one of them resulting in a fine of ~5% of the yearly revenue.