Tracing security leaks is like patching the hull of a sinking ship.