3 citations · 9 across the 12 of their papers we have counts for
13 papers
From Adoption to Deployment: A Qualitative Study on AI Integration in Software Development Practice
Mahzabin Tamanna, Elizabeth Lin, Sparsha Gowda +2
The increasing adoption of Large Language Models (LLMs) as AI components in modern software systems introduces distinct security risks to the software supply chain. While many cons…
S3C2 Summit 2025-09: Industry Secure Supply Chain Summit
Md Atiqur Rahman, Yasemin Acar, Michel Cucker +5
Today's digital ecosystem relies heavily on software supply chains, which enable developers to reuse code and ship software at scale. However, a single vulnerable component can jeo…
S3C2 Summit 2025-07: Government Secure Supply Chain Summit
Sivana Hamer, Pat Morrison, William Enck +6
Software supply chains, while providing immense economic and software development value, are only as strong as their weakest link. Over the past several years, there has been an ex…
S3C2 SICP Summit 2025-06: Vulnerability Response Summit
Anna Lena Rotthaler, Simon Oberthür, Juraj Somorovsky +9
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing significant damage to businesses and organizations. The US a…
Your Build Scripts Stink: The State of Code Smells in Build Scripts
Mahzabin Tamanna, Yash Chandrani, Matthew Burrows +3
Build scripts automate the process of compiling source code, managing dependencies, running tests, and packaging software into deployable artifacts. These scripts are ubiquitous in…
S3C2 Summit 2024-09: Industry Secure Software Supply Chain Summit
Imranur Rahman, Yasemin Acar, Michel Cukier +5
While providing economic and software development value, software supply chains are only as strong as their weakest link. Over the past several years, there has been an exponential…
S3C2 Summit 2024-08: Government Secure Supply Chain Summit
Courtney Miller, William Enck, Yasemin Acar +5
Supply chain security has become a very important vector to consider when defending against adversary attacks. Due to this, more and more developers are keen on improving their sup…
S3C2 Summit 2023-11: Industry Secure Supply Chain Summit
Nusrat Zahan, Yasemin Acar, Michel Cukier +5
Cyber attacks leveraging or targeting the software supply chain, such as the SolarWinds and the Log4j incidents, affected thousands of businesses and their customers, drawing atten…
What's in a Package? Getting Visibility Into Dependencies Using Security-Sensitive API Calls
Imranur Rahman, Ranidya Paramitha, Henrik Plate +2
Knowing what sensitive resources a dependency could potentially access would help developers assess the risk of a dependency before selection. One way to get an understanding of th…
S3C2 Summit 2024-03: Industry Secure Supply Chain Summit
Greg Tystahl, Yasemin Acar, Michel Cukier +5
Supply chain security has become a very important vector to consider when defending against adversary attacks. Due to this, more and more developers are keen on improving their sup…
Pushed by Accident: A Mixed-Methods Study on Strategies of Handling Secret Information in Source Code Repositories
Alexander Krause, Jan H. Klemmer, Nicolas Huaman +3
Version control systems for source code, such as Git, are key tools in modern software development. Many developers use services like GitHub or GitLab for collaborative software de…
"Please help share!": Security and Privacy Advice on Twitter during the 2022 Russian Invasion of Ukraine
Juliane Schmüser, Noah Wöhler, Harshini Sri Ramulu +4
The Russian Invasion of Ukraine in early 2022 resulted in a rapidly changing (cyber) threat environment. This changing environment incentivized the sharing of security advice on so…
A Large Scale Investigation of Obfuscation Use in Google Play
Dominik Wermke, Nicolas Huaman, Yasemin Acar +3
Android applications are frequently plagiarized or repackaged, and software obfuscation is a recommended protection against these practices. However, there is very little data on t…