Up to 40% of GitHub Copilot's generated code can be vulnerable