Towards Evidence-Based Assessment Of Factors Contributing To The Introduction And Detection Of Software Vulnerabilities