How Snyk finds out about new vulnerabilities