QA Report

[code423n4]

Several improvements needed in Vanilla Governable contract

Consider adding Two-step transfer ownership pattern in setGovernance function

function setGovernace(address _governance) external onlyGovernance {
    _setGovernace(_governance);
}

This function is dangerous because do not even check if _governance!=address(0) so probability to make a mistake is higher. Maybe this issue can even be considered medium for that reason.
You can add that check or implement two-step transfer ownership with functions setPendingGovernance and acceptGovernance

Consider adding emit event when setting new governance

event newPendingGovernance(address pendingGovernance);
event newGovernance(address governance);