Stuff that is done to find Privoxy bugs before they affect the users - Static code analysis - Code review of new and existing code - Privoxy-Regression-Test (executes mostly Privoxy-specific tests) - Curl's test suite (Currently 267 HTTP tests) - Valgrind - Fuzzing (zzuf, proxyfuzz, "internal" fuzzers, afl-fuzz) - Manual testing As a result, Privoxy can be considered moderately well tested. Most bugs are found "internally", not always before the release, though.