How do you teach students to find security bugs in code they didn't write?

I run a practical module where students have to audit a small open-source project for vulnerabilities, and many of them freeze when the code isn't theirs.

They can spot issues in textbook examples but struggle to reason about unfamiliar codebases under time pressure.

How do you structure these exercises so students build real auditing confidence rather than just pattern-matching?