Martin Monperrus

The paper introduces 'software supply chain smells,' structural indicators of security risks in third-party dependencies, and presents Dirty-Waters, a tool that detects these smells, finding that different ecosystems (Maven vs. NPM) exhibit distinct security weaknesses.

This paper provides the first comprehensive study of cryptographic API misuse detection in Go, evaluating four state-of-the-art tools and discovering 7,473 instances of cryptographic API misuses across 328 open-source projects.

zkSBOM introduces a zero-knowledge mechanism for sharing Software Bills of Materials (SBOMs) that allows consumers to check for vulnerabilities without suppliers revealing the full, sensitive contents of the SBOM.

The authors argue that coding agents can replace traditional human code review in software development.

This paper revisits N-version programming with AI coding agents and finds substantial common-mode failures but also practical benefits.

The paper presents BigBag, an agentic framework that generates reusable fixing transformations for third-party library breaking API changes, achieving a compilable transformation rate of 94.3% and a fix rate of 78.6%.

This paper explores the use of smart contract invariants to protect against cyber attacks in blockchains, demonstrating their effectiveness through an experimental protocol and validation with real-world exploits.