If two weeks is sufficient, why aren't more people finding these things? Isn't there a big incentive to make sure that e.g. popular web frameworks are secure?