But wasn't the whole (claimed) reason that it got banned in the first place that it is a logical impossibility? Reviewing code for bugs is legitimate. Writing regression tests for bugs is legitimate. If the bug happens to be a security issue then the regression test may be a PoC or at least a step towards one.