How Do I Know If My Codebase Is Safe?

A codebase can pass CI, have 80% test coverage, produce no critical SAST findings, and still be unsafe.