Using sentiment analysis on keywords in commit messages isn't "empirical," lol.
What an absolute joke of a paper
Using keywords in git commits as a sign of a vulnerability seems like an extremely flawed way of doing this. This seems just as bad as early "sentiment analysis" of tweets back in the day.
Why? At first glance, I did not find anything that could justify your assessment.