1. A computer-implemented method for protecting software, comprising: inserting constraint code into a computer program at a patch point, the inserting of the constraint code occurring during runtime of the computer program; executing the constraint code when a control flow of the computer program reaches the patch point; wherein the constraint code calls a library of detector and/or remediator functions, each detector function detecting when a vulnerability is invoked in the computer program without altering a state of the computer program and each remediator function taking remediation action to fix a vulnerability; and dynamically switching the constraint code, as the computer program is running, between a detection mode in which invocation of a vulnerability in a computer program is detected, but no remediation action is taken, and a protection mode, in which invocation of the vulnerability in the computer program is detected, and remediation action is taken in response to the detection of the invocation, wherein executing the constraint code when the control flow of the computer program reaches the patch point comprises: calling a detector function in the library without calling a remediator function in the library when the constraint code has been dynamically switched to the detection mode, and calling a detector function in the library and a remediator function in the library when the constraint code has been dynamically switched to the remediation mode.