Ten commandments for software security