He's doing the ops-y abuse-y bot-y stuff he's been doing for the last decade, from what I can tell. He's not in the branch of security that cares deeply about secure code.