How to recognize vulnerabilities between commits