A computer-implemented method for protecting software, characterised by: installing a node manager on a node of a computer system; dynamically loading, by the node manager, a constraint library into a computer program (320, 440) to be protected, wherein the constraint library comprises a plurality of constraints, each constraint in the constraint library comprising (i) a constraint descriptor providing patch point information of the constraint and (ii) constraint code of the constraint, the constraint code comprising machine instructions that correct a flaw in the computer program, the flaw being a security vulnerability or a bug; providing a managed program execution engine 'MPEE'; determining, by the MPEE, insertion point information for the computer program (320, 440) according to the patch point information of the constraint in the constraint library; analysing, by the MPEE, the computer program (320, 440) to determine an insertion point to insert the constraint code of the constraint based on the insertion point information; inserting, by the MPEE, the constraint code into the computer program to be protected at the patch point which is between instructions of the computer program, by at least one of: copying a code fragment of the computer program to a cache and inserting at least one instruction of the constraint code into the code fragment in the cache, or replacing at least one instruction of the computer program with at least one instruction of the constraint code and storing the at least one replaced instruction at a gateway function; providing a constraint management engine 'CME' in communication with the node manager and the MPEE; dynamically, by the CME, turning on or off the constraint of the loaded constraint library while the computer program is running, in response to user input; and providing a constraint gateway in communication with the CME; receiving, by the constraint gateway, a communication from the CME indicating whether the constraint is turned on or off; executing the constraint code when a control flow of the computer program reaches the patch point of the code fragment in the cache; receiving, by the constraint gateway, a call from the constraint code and determining whether the machine instructions that correct the flaw of the computer program should be called or not according to whether the constraint is turned on or off. installing a node manager on a node of a computer system; dynamically loading, by the node manager, a constraint library into a computer program (320, 440) to be protected, wherein the constraint library comprises a plurality of constraints, each constraint in the constraint library comprising (i) a constraint descriptor providing patch point information of the constraint and (ii) constraint code of the constraint, the constraint code comprising machine instructions that correct a flaw in the computer program, the flaw being a security vulnerability or a bug; providing a managed program execution engine 'MPEE'; determining, by the MPEE, insertion point information for the computer program (320, 440) according to the patch point information of the constraint in the constraint library; analysing, by the MPEE, the computer program (320, 440) to determine an insertion point to insert the constraint code of the constraint based on the insertion point information; inserting, by the MPEE, the constraint code into the computer program to be protected at the patch point which is between instructions of the computer program, by at least one of: copying a code fragment of the computer program to a cache and inserting at least one instruction of the constraint code into the code fragment in the cache, or replacing at least one instruction of the computer program with at least one instruction of the constraint code and storing the at least one replaced instruction at a gateway function; providing a constraint management engine 'CME' in communication with the node manager and the MPEE; dynamically, by the CME, turning on or off the constraint of the loaded constraint library while the computer program is running, in response to user input; and providing a constraint gateway in communication with the CME; receiving, by the constraint gateway, a communication from the CME indicating whether the constraint is turned on or off; executing the constraint code when a control flow of the computer program reaches the patch point of the code fragment in the cache; receiving, by the constraint gateway, a call from the constraint code and determining whether the machine instructions that correct the flaw of the computer program should be called or not according to whether the constraint is turned on or off.