7 papers
An Empirical Study of Security Calibration in Large Language Models for Code
Mohammed Latif Siddiq, Md. Nafiu Rahman, Joanna C. S. Santos
Large Language Models (LLMs) are rapidly transforming software development, yet their use in security-critical contexts raises a key question: do models know when their generated c…
Automated Detection of Configuration-Specific Security Vulnerabilities via Patch Analysis
Felipe de Sant'Anna Paixão, Joanna C. S. Santos, Paulo Anselmo da Mota Silveira Neto +3
We study how security patches in highly configurable C/C++ systems map onto the space of compile-time variants. We formalize the Vulnerability Impact Condition (VIC) - a Boolean pr…
Characterizing and Modeling the GitHub Security Advisories Review Pipeline
Claudio Segal, Paulo Segal, Carlos Eduardo Banjar +8
GitHub Security Advisories (GHSA) have become a central component of open-source vulnerability disclosure and are widely used by developers and security tools. A distinctive featur…
An Empirical Study on Remote Code Execution in Machine Learning Model Hosting Ecosystems
Mohammed Latif Siddiq, Tanzim Hossain Romel, Natalie Sekerak +2
Model-sharing platforms, such as Hugging Face, ModelScope, and OpenCSG, have become central to modern machine learning development, enabling developers to share, load, and fine-tun…
Security in the Age of AI Teammates: An Empirical Study of Agentic Pull Requests on GitHub
Mohammed Latif Siddiq, Xinye Zhao, Vinicius Carvalho Lopes +2
Autonomous coding agents are increasingly deployed as AI teammates in modern software engineering, independently authoring pull requests (PRs) that modify production code at scale.…
Assessing the Software Security Comprehension of Large Language Models
Mohammed Latif Siddiq, Natalie Sekerak, Antonio Karam +3
Large language models (LLMs) are increasingly used in software development, but their level of software security expertise remains unclear. This work systematically evaluates the s…