@drwhax
I'm glad you've invited discussions on this, because my immediate thoughts and questions diverge from the discussion I'm primarily seeing here. When you mention vulnerabilities, yes you mention they exist in code as well as in projects. When I think of vulnerabilities, I think of the method I am using to make and maintain a record of something or else to achieve a goal or state of physical safety. For example, if my household accounting spreadsheets and forecasts are handwritten then the vulnerability is risk of loss if the dog eats them, but risk is mitigated when I keep an offline digital file. When a family member starts a small business, I ask the questions learnt in my accounting and auditing classes because I believe the risks involved include thinking about how to prevent losses of whatever is important. I only had a couple of BASIC programming classes in 1984, but it seemed to me that in those days the instructor felt we should understand the process so that we could consider risks. I now wonder if the machine-assisted searching allows you to consider the assorted practical situations of each business whose vulnerabilities are being sought.