Lessons from building Sherlock: Automating security code reviews / hacker news