It might be possible to learn from the change history of the projects. There's likely quite many commits which fix certain security issues, such as SQL injectio

It might be possible to learn from the change history of the projects. There's likely quite many commits which fix certain security issues, such as SQL injection problems. Maybe even with suitable metadata in the issues or commit messages.