How do you know your code is secure?

bvc writes: "Marucs Ranum says: "It's really hard to tell the difference between a program that works and one that just appears to work." Then he explains how he just found a buffer overflow in Firewall Toolkit (FWTK) code he wrote in 1994. Read the whole thing here. So how do you go about making sure your code is secure? Especially if you have to write in a language like C or C++?"