Using sentiment analysis on keywords in commit messages isn't "empirical," lol.

What an absolute joke of a paper

Using keywords in git commits as a sign of a vulnerability seems like an extremely flawed way of doing this. This seems just as bad as early "sentiment analysis" of tweets back in the day.

Why? At first glance, I did not find anything that could justify your assessment.