Agree with wycks, without proof of concept the report is about bad coding styles and not about exploits.
For example there might be an unescaped sql statement which the automatic tool might flag, but if the path to get to that code is available only to the admin of the site then it is not an exploit.

Not even sure that a different review process will help because in the end of the day it takes an expert to find exploits. githuib might be nicer for use then trac but having 1M developers forking and pulling a specific code doesn't improve the security of the code if none of them are security experts. If you just needed better version control tools to improve security then by now microsoft etc would not have had any security problems.