Classes of Defect

A class of defect is a category of product defect that recurs across products, codebases, and time — such as buffer overflows, SQL injection, or use-after-free errors.

Many are predictable and preventable defects that should be eliminated at the root.

Eliminating a class of defect means making it structurally impossible, not just fixing individual instances. This is a core goal of secure-by-design software.

When a product ships with the same class of defect it shipped with last year, it signals that the fix was applied to the symptom, not the cause.

Discussion prompts

• What classes of defect have appeared most often in your products?
• Is your team fixing individual bugs or eliminating the conditions that produce them?
• Which class of defect in your codebase could be eliminated by a language or framework change?