I've been reading about the object-capability model as seen in the E programming language.
It reminds me of dependency injection, but used pervasively. Rather than calling static methods, you pass in object arguments and call methods in them.
miniblog.
Related Posts
One underrated advantage of ORMs: it's significantly harder to write code vulnerable to SQL injection.
Several security vulnerability types are due to misusing strings: command injection, SQL injection, cross-site scripting.
How far could you go with a language that didn't have strings? You might need a Prose type that's a list of Unicode chars, but only use it for printing.
Cute idea (in a rather dramatic blog post): randomly generate strings for PL keywords, and apply the same transformation to your source code.
This prevents code injection: https://blog.polyverse.io/introducing-polyscripting-the-beginning-of-the-end-of-code-injection-fe0c99d6f199
(I suppose you could brute force, and they don't say if it breaks eval.)