I would simply write code that doesn't have vulnerabilities in the first place.

Brilliant! Why hasn't anyone thought of this?