A security policy oracle: detecting security holes using multiple API implementations
Have things changed now?: an empirical study of bug characteristics in modern open source software