Quiz Entry - updated: 2026.07.14
What is the difference between a flaw and a bug in software?
A flaw is a defect in the design; a bug is a defect in the implementation.
The distinction matters because the two are caught and fixed in very different ways:
| Flaw | Bug | |
|---|---|---|
| Where it lives | Architecture / design decision | Code / implementation detail |
| How it's found | Design review, threat modelling | Code review, testing, static analysis, fuzzing |
| How it's fixed | Redesign — often expensive, may require rewrite | Patch the offending lines |
| Example | "We store session tokens in localStorage" (XSS will leak them) |
strcpy(buf, input) with no length check |
Tip: Bugs you can find with a debugger. Flaws you can only find by thinking about the system. That's why threat modelling exists — testing alone won't catch design-level issues.