To be fair the overhead of bounds checking GCC was rather large. Valgrind is a better and there's no excuse for not using it in your test suite. I doubt valgrind could realistically be used in production. -D_FORTIFY_SOURCE (=2) is used in production everywhere, assuming you're running some Red Hat or SUSE derived distro.