vulnerable-code/SAST-Benchmark has no contributors in the loaded window — nobody pushed, opened or commented on it — so there is nothing to find overlap with. A repository whose only activity is stars and forks cannot be related to anything this way.