[Problem:] Free and Open Source Software (FOSS) components are ubiquitous in both proprietary and open source applications. Each time a vulnerability is disclosed in a FOSS component, a software vendor using this component in an application must decide whether to update the [deployed] FOSS component, patch the application itself, or just do nothing as the vulnerability is not applicable to the older deployed version. [Challenge:] Vendors that consume thousands of FOSS components and offer more than a decade of support and security fixes are expected to react quickly on disclosed vulnerabilities—in some case such as Heartbleed, within hours. [Technical Solution:] We propose a screening test: a novel, automatic method based on thin slicing, for estimating quickly whether a given vulnerability is present in a consumed FOSS component by looking across its entire repository. [Empirical Validation:] Our screening test scales to large open source projects (e.g., Apache Tomcat, Spring Framework, etc.), scanning thousands of commits and hundred thousand lines of code in minutes. Further, we provide insights on the empirical probability that, on 166 FOSS projects, a potentially vulnerable component might not actually be vulnerable after all. [Interest for ICSE and Industry:] code analysis methods usually presented at ICSE are based on precise but costly semantic analysis (symbolic execution, concolic testing, etc.). Our radical alternative deliberately trades accuracy for speed. Its application by our industry partner is not intended to replace semantics analysis but to prioritize its application to versions most at risk.