How to identify software vulnerabilities