A ground-truth dataset of real security patches