Post navigation Open source software security vulnerabilities exist for over four years before detection