Public sector security debt and application risk management was analyzed in a recent report by Veracode, finding 3% of applications are flaw free.