This study provides an ecosystem-scale measurement of commit signing on GitHub, finding that current signing adoption rates are misleading and that developers struggle to maintain consistent, long-ter…

Phoenix is a multi-agent system that uses seven safety controls and a test evaluation strategy to resolve GitHub issues, achieving 75% oracle-resolution with no regressions on a curated benchmark and…

This paper explores the causes of inconsistent vulnerability scanner findings in the open-source ecosystem.

This survey analyzed 132 web application security tutorials, finding that most lack concrete implementation details and recommending that the presence of runnable code and links to official resources…

This paper proposes the trans-domain digital twin approach to connect heterogeneous domain twins through aligned shared state, explicit coupling, heterogeneous temporal coordination, joint decision-ma…

OxyMake is a content-addressed cache key workflow engine that replaces mtime with a BLAKE3 hash for caching decisions, eliminating spurious re-runs and traveling across machines and shared caches.

The paper introduces a new structural merge tool that ensures parsability and universality in comparison to existing tools, resulting in fewer incorrect merge results.

This paper presents an empirical investigation on the distribution, evolution, and maintenance implications of Domain-Driven Design (DDD) building blocks in open-source GitHub repositories.

This paper conducts rapid reviews of peer-reviewed publications to assess the availability of evidence on software engineering practices in government agencies.

This paper compares the quality and coverage of epic-organized LLM-generated Gherkin acceptance criteria with requirement-aligned generation, using four requirements documents from the PURE dataset.

The paper argues that current Software Bills of Materials (SBOMs) are fundamentally flawed due to a lack of shared understanding regarding what constitutes a 'component,' demonstrating that existing t…

The paper introduces CrossCommitVuln-Bench, a benchmark dataset demonstrating that many real-world Python vulnerabilities are introduced across multiple commits, making them invisible to standard per-…

A longitudinal study of five identity-based signing ecosystems found that while these tools reduce some key management burdens, they consistently shift complexity to verification workflows, policy con…

Proposed ProjAgent, a repository-level code generation system using procedural similarity for retrieval and conservative static-analysis feedback.

This paper revisits N-version programming with AI coding agents and finds substantial common-mode failures but also practical benefits.

The paper introduces Code-QA-Bench, a novel framework that rigorously separates genuine code reasoning from mere documentation memorization in repository-level code understanding benchmarks.

The paper analyzes GitHub security advisories for LLM-integrated open-source systems, finding that while most vulnerabilities map to existing code-level weaknesses, the architectural risks like Supply…