> If the mere presence of tests expose security vulnerabilities your product is insecure irrespective of the tests.
Wait... I may be misunderstanding but in the xz backdoor we just had, had the tests not be ran in prod, the attacker would have had no way to ever ship its mandatory evil binary payload and the attack would have been stopped dead in its track.
I'm very surprised to see this dismissed as "unrelated" when not including the test files in the prod environment would have prevented that exploit.
At least as I understand it.
