This talk outlines my work preventing bugs using a blend of programming languages techniques and systems design. First, I’ll talk about securing massive, security-critical codebases without clean slate rewrites. This means rooting out hard-to-find bugs—as in Sys, which scales symbolic execution to find exploitable bugs in systems like the twenty-million line Chrome browser. It also means proving correctness of especially vulnerable pieces of code—as in VeRA, which automatically verifies part of the Firefox JavaScript engine. Finally, I’ll discuss work on stronger foundations for new systems—as in CirC, a recent project unifying compiler infrastructure for program verification, cryptographic proofs, optimization problems, and more.