software vetting