The life and death of statically detected vulnerabilities: An empirical study