# Your compiler can undo your security checks

> Chris Domas shows how legal compiler optimizations strip out the protections you carefully wrote.
- Title: Your compiler can undo your security checks · Davidbombal
- Summary: Chris Domas shows how legal compiler optimizations strip out the protections you carefully wrote. Audit the optimized binary you actually ship, not the…
- Keywords: secure coding, compilers, vulnerabilities, black hat, technology, startups, compiler, undo, security, checks, Davidbombal
- Source: Davidbombal — https://davidbombal.com/your-compiler-can-undo-your-security-checks
- Author: Davidbombal
- Published: 2026-09-04T01:15:10+00:00
- Read time: 1 min
- Topics: secure coding, compilers, c, vulnerabilities, black hat, technology, startups
## The CPU never reads your code
You can write careful C, follow every best practice, and still ship a vulnerable binary. The processor runs what the compiler emitted, not what you typed.

> the CPU does not run your source code
## Optimizations delete protections
At Black Hat, Chris Domas walks through legal optimizations that strip security checks, drop memory-clearing calls, and turn safe-looking code into time-of-check to time-of-use bugs.
## Blame the abstract machine
C is defined against an abstract machine, which gives compilers permission to transform code dramatically. If a wipe or check has no observable effect, it can legally vanish.
## Byte counts decide your fate
Register pressure, struct layout, and plain data size all shift the outcome. In one example, 17 or 33 bytes compile safely while neighboring sizes produce vulnerable code.
## Rust and Clang are not the fix
Swapping GCC for Clang just moves the problem around, and Rust does not make it disappear. An AI pass over 500 million lines of open source turned up 300 suspect patterns.
## What developers can do now
Turn on compiler warnings, run sanitizers, read the optimized build rather than the debug one, and test the exact binary you are about to ship.
## Key takeaway

Audit the optimized binary you actually ship, not the source you wrote, because the compiler is allowed to remove your safety code.