Empirical analysis of 444 iOS apps using dynamic traffic interception found 282 leaking LLM API keys across ten providers, with only 28% remediation after three months.
hub
In: Proceedings of the 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), pp
17 Pith papers cite this work, alongside 10 external citations. Polarity classification is still indexing.
17
Pith papers citing it
10
external citations · external index
hub tools
citation-role summary
background 3
citation-polarity summary
roles
background 2polarities
background 2representative citing papers
Constrained Diffusion for Code (CDC) integrates constraint satisfaction into the reverse denoising process of discrete diffusion models via constraint-aware operators that use optimization and program analysis to steer generation toward feasible programs.
The paper delivers a taxonomy of seven LLM study types in software engineering along with eight guidelines that separate mandatory requirements from recommended practices to address reproducibility challenges.
Vibe-coded software shows near-zero in-artifact variability; Variability by Regeneration uses the LLM as a derivation engine that regenerates dead-code-free binaries for each product-line variant.
A critical discourse analysis of 200 YouTube software engineering tutorials finds male characters and masculine defaults dominate, with an agency gap assigning technical roles almost exclusively to males.
MA-CoT prompting reduces security findings in LLM-generated code by 57.6% on a 200-task dataset and 94.5% on LLMSecEval across C, Java, and Python, outperforming vanilla, zero-shot, and standard CoT strategies.
A within-subject study of 12 developers found that security training reduced validated weaknesses by 31.5% and critical issues by 79.2% in LLM-assisted backend coding.
Longitudinal analysis of over 4000 toggle events in Kubernetes and GitLab shows removals lag additions, leading to growing inventories with median lifespans of 734 and 185 days, plus a benchmarking framework with five metrics.
A taxonomy-guided RAG system with LLMs reduces hallucinations and improves migration suggestions for Qiskit code compared to unconstrained retrieval.
ML-specific code smells occur 41-94 times less often than general Python smells in 279 projects, with associations to commit frequency and domain but none for general smells or most other project characteristics.
Introduces a taxonomy of nine LLM code smells, a static detection tool, and reports 73.5% prevalence with 91.3% precision and 71.8% recall across 692 projects.
BPE tokenization creates gibberish bias in CLLMs, causing secrets with high character entropy but low token entropy to be preferentially memorized due to training data distribution shifts.
xDECAF is an extensible, open-source framework for architecture-based data flow analysis with a constraint DSL, web editor, and a catalog of 26 example models for information security.
Forum discussions highlight four security concerns with GitHub Copilot: data leakage, code licensing problems, adversarial attacks such as prompt injection, and generation of insecure code.
The submission's abstract claims a CPG-based ML smell detector with 88.14% recall, but the full text implements an AST-only DSL detector with 88.89% recall, and no CPG experiment appears.
The authors present a registered report outlining their planned large-scale empirical study of vulnerability communication in pull requests by different account types.
citing papers explorer
-
Mind your key: An Empirical Study of LLM API Credential Leakage in iOS Apps
Empirical analysis of 444 iOS apps using dynamic traffic interception found 282 leaking LLM API keys across ten providers, with only 28% remediation after three months.
-
Constrained Code Generation with Discrete Diffusion
Constrained Diffusion for Code (CDC) integrates constraint satisfaction into the reverse denoising process of discrete diffusion models via constraint-aware operators that use optimization and program analysis to steer generation toward feasible programs.
-
Guidelines for Empirical Studies in Software Engineering involving Large Language Models
The paper delivers a taxonomy of seven LLM study types in software engineering along with eight guidelines that separate mandatory requirements from recommended practices to address reproducibility challenges.
-
Where Did the Variability Go? From Vibe Coding to Product Lines by Regeneration
Vibe-coded software shows near-zero in-artifact variability; Variability by Regeneration uses the LLM as a derivation engine that regenerates dead-code-free binaries for each product-line variant.
-
A Critical Discourse Analysis of Gender Representation in Software Engineering Education Videos on YouTube
A critical discourse analysis of 200 YouTube software engineering tutorials finds male characters and masculine defaults dominate, with an agency gap assigning technical roles almost exclusively to males.
-
Enhancing Reliability in LLM-Based Secure Code Generation
MA-CoT prompting reduces security findings in LLM-generated code by 57.6% on a 200-task dataset and 94.5% on LLMSecEval across C, Java, and Python, outperforming vanilla, zero-shot, and standard CoT strategies.
-
A Quasi-Experimental Developer Study of Security Training in LLM-Assisted Web Application Development
A within-subject study of 12 developers found that security training reduced validated weaknesses by 31.5% and critical issues by 79.2% in LLM-assisted backend coding.
-
Feature Toggle Dynamics in Large-Scale Systems: Prevalence, Growth, Lifespan, and Benchmarking
Longitudinal analysis of over 4000 toggle events in Kubernetes and GitLab shows removals lag additions, leading to growing inventories with median lifespans of 734 and 185 days, plus a benchmarking framework with five metrics.
-
Qiskit Code Migration with LLMs
A taxonomy-guided RAG system with LLMs reduces hallucinations and improves migration suggestions for Qiskit code compared to unconstrained retrieval.
-
Comparing ML-Specific and General Python Code Smells Across Project Characteristics
ML-specific code smells occur 41-94 times less often than general Python smells in 279 projects, with associations to commit frequency and domain but none for general smells or most other project characteristics.
-
LLM Code Smells: A Taxonomy and Detection Approach
Introduces a taxonomy of nine LLM code smells, a static detection tool, and reports 73.5% prevalence with 91.3% precision and 71.8% recall across 692 projects.
-
Understanding Secret Leakage Risks in Code LLMs: A Tokenization Perspective
BPE tokenization creates gibberish bias in CLLMs, causing secrets with high character entropy but low token entropy to be preferentially memorized due to training data distribution shifts.
-
xDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security
xDECAF is an extensible, open-source framework for architecture-based data flow analysis with a constraint DSL, web editor, and a catalog of 26 example models for information security.
-
Security Concerns in Generative AI Coding Assistants: Insights from Online Discussions on GitHub Copilot
Forum discussions highlight four security concerns with GitHub Copilot: data leakage, code licensing problems, adversarial attacks such as prompt injection, and generation of insecure code.
-
SpecDetect4ML: Detecting Non-Local ML Code Smells with Code Property Graphs
The submission's abstract claims a CPG-based ML smell detector with 88.14% recall, but the full text implements an AST-only DSL detector with 88.89% recall, and no CPG experiment appears.
-
How Humans, Bots, and Agents Communicate About Vulnerabilities in Pull Requests
The authors present a registered report outlining their planned large-scale empirical study of vulnerability communication in pull requests by different account types.
- What Breaks When LLMs Code? Characterizing Operational Safety Failures of Agentic Code Assistants