In reply to Miroslav Glavic.

No security audits are perfect, and will catch absolutely everything.

We do regularly audit the codebase for Jetpack and all our products, and even occasionally hire outside firms to conduct extensive audits -- we had a full audit of the full Jetpack plugin done right around a similar security incident two years ago. It didn't find this either.

I'm somewhat concerned that you think the answer to security problems seems to be just "throw more audits at it" -- it's not. It's a comprehensive approach including auditing as well as running a bug bounty program and proactively considering security implications of changes before implementing them.

As it is, the 'shortcode' implementation issues were the last vestiges of some legacy code that had been used to implement shortcodes before shortcodes were even a thing in WordPress. And they interacted with some core content filters in interesting ways so that it was possible to finagle the right mix of escaping and unescaping quotation marks in content. Not easy or obvious, hence how it got missed.

Once it was discovered, we addressed it as thoroughly and promptly and securely as we are able.