How I used AI to find vulnerabilities in TanStack Query and Apache Airflow and actually got CVEs assigned. Yes, you can do it too.