Code-level vulnerabilities