I think Matt Godbolt said he found it impossible to fix all the ACE vulnerabilities on godbolt.com (before code execution was a feature), and that was only GCC command line flags, not even makefiles.