That just takes you back to the debate about the code being the spec.

The code lets you shoot yourself in the foot in a lot more ways than a spec does, though. Few people would make specs that include buffer overflows or SQL injection.

"and don't have any security vulnerabilities" isn't a spec though. As soon as you get specific you're right back in it.