If your checklist says "memcpy is forbidden", and you encode that in a static analyer (test), heardbleed would be prevented.