Vulnerabilities in build-metrics