Yes, I was thinking along similar lines. If your coding standard strictly prevents known dangerous habits (and it should be for security related code).
Insisting on putting all if body statements in braces would have prevented the Apple bug.
A pre-processor checking for violations should be possible too.
The heart bleed one seems much less related to language and more about design. The flaw was not spotting that a user supplied value was passed in to a dangerous function. Explicitly denoting what is trusted and what is not could possibly be a feature of a language out there, I don't know, but it's certainly something that could be architected in an existing language.
So this is allowed:
But this isn't: And this isn't: Edit: formatting