I tend to assume that mature products eventually reach the point where they do not have basic vulnerabilities any more, but evidently that is not true. In this talk, Julien Vehent of Firefox talks about receiving bug bounty reports that include basic XSS attacks. He then reveals how Firefox is trying to address these with Test Driven Security, which sounds a bit like it was inspired by either a less strict version of Test Driven Development & Behavioral Driven Development
https://www.youtube.com/watch?v=e2axToBYD68