All AppSec vulnerabilities are not equal, but why do some seem so much more equal than others? Analysis