Also, I like to add a test for something every time someone reports a bug, to make sure there are no regressions (specially if it's a security problem). It also helps reproducing the bug and documenting it.