Prioritise memory safe languages wherever possible (C#, Rust, Ruby, Java, Go and Swift are given as examples). The October 2023 text accepts language improvements, hardware mitigations, ASLR, control-flow integrity and fuzzing as shorter-term measures for legacy code; the April 2023 text had called such mitigations insufficient to count as secure by design.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.