How to identify opensource code vulnerabilities