An Empirical Study of Security-Policy Related Issues in Open Source Projects
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2025
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866909849334317056 |
|---|---|
| author | Kanaji, Rintaro Reid, Brittany Kashiwa, Yutaro Kula, Raula Gaikovina Iida, Hajimu |
| author_facet | Kanaji, Rintaro Reid, Brittany Kashiwa, Yutaro Kula, Raula Gaikovina Iida, Hajimu |
| contents | GitHub recommends that projects adopt a security file that outlines vulnerability reporting procedures. However, the effectiveness and operational challenges of such files are not yet fully understood. This study aims to clarify the challenges that security files face in the vulnerability reporting process within open-source communities. Specifically, we classified and analyzed the content of 711 randomly sampled issues related to security files. We also conducted a quantitative comparative analysis of the close time and number of responses for issues concerning six community health files, including security files. Our analysis revealed that 79.5% of security file-related issues were requests to add the file, and reports that included links were closed, with a median time that was 2 days shorter. These findings offer practical insights for improving security reporting policies and community management, ultimately contributing to a more secure open-source ecosystem. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2510_05604 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | An Empirical Study of Security-Policy Related Issues in Open Source Projects Kanaji, Rintaro Reid, Brittany Kashiwa, Yutaro Kula, Raula Gaikovina Iida, Hajimu Software Engineering GitHub recommends that projects adopt a security file that outlines vulnerability reporting procedures. However, the effectiveness and operational challenges of such files are not yet fully understood. This study aims to clarify the challenges that security files face in the vulnerability reporting process within open-source communities. Specifically, we classified and analyzed the content of 711 randomly sampled issues related to security files. We also conducted a quantitative comparative analysis of the close time and number of responses for issues concerning six community health files, including security files. Our analysis revealed that 79.5% of security file-related issues were requests to add the file, and reports that included links were closed, with a median time that was 2 days shorter. These findings offer practical insights for improving security reporting policies and community management, ultimately contributing to a more secure open-source ecosystem. |
| title | An Empirical Study of Security-Policy Related Issues in Open Source Projects |
| topic | Software Engineering |
| url | https://arxiv.org/abs/2510.05604 |