Using keywords in git commits as a sign of a vulnerability seems like an extremely flawed way of doing this. This seems just as bad as early "sentiment analysis" of tweets back in the day.

Why? At first glance, I did not find anything that could justify your assessment.