Identifying vulnerability-inducing commits requires reasoning about code evolution across revisions, not just finding where vulnerable code was last modified—TraceVIC achieves 28.7% improvement over existing methods by modeling full revision history.
TraceVIC identifies which commit introduced a software vulnerability by analyzing how vulnerable code evolved across a project's revision history. Instead of using simple heuristics like "earliest change," it builds temporal graphs showing code structure and evolution, then reasons over this history to rank commits by their contribution to the vulnerability.