Semgrep misses vulnerabilities