>>>> TOOL DEMO SCREENCAST: please download file tool_demo_final.mp4. <<<< ABSTRACT: Though vulnerability databases are key for monitoring known vulnerabilities in open-source projects, they rarely contain information about the code changes that fix the flaws they describe. Finding them is time-consuming and error-prone as it involves the analysis of multiple, unstructured resources. In this paper we present \prospector, a tool that supports mapping vulnerability advisories from vulnerability databases onto the corresponding fix in the source code. \prospector employs a set of heuristics that mimics and automates the strategies that would be employed by human security experts. Given an advisory expressed in natural language, \prospector processes the commits found in the target source code repository, ranks them based on a set of predefined rules, and produces a report that the user can inspect to determine which commits to retain as the actual fix. The tool is publicly available and is released under the Apache 2.0 license.