{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:YNBPIZRNUFH7YQUVPX2PNYRVHH","short_pith_number":"pith:YNBPIZRN","canonical_record":{"source":{"id":"2507.17324","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-07-23T08:45:53Z","cross_cats_sorted":[],"title_canon_sha256":"a1b587ec420a068c0aa8f53104e06c5ba6fd27480ace5721dc8eed3c26be2976","abstract_canon_sha256":"81e4f021cc9de29cf4e37ce95c21a5c7b0faac273f3940a02c9cc62a9e094957"},"schema_version":"1.0"},"canonical_sha256":"c342f4662da14ffc42957df4f6e23539f7e6b4a16c5ee69b2298ed3b763cfaf9","source":{"kind":"arxiv","id":"2507.17324","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.17324","created_at":"2026-07-05T11:42:34Z"},{"alias_kind":"arxiv_version","alias_value":"2507.17324v2","created_at":"2026-07-05T11:42:34Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.17324","created_at":"2026-07-05T11:42:34Z"},{"alias_kind":"pith_short_12","alias_value":"YNBPIZRNUFH7","created_at":"2026-07-05T11:42:34Z"},{"alias_kind":"pith_short_16","alias_value":"YNBPIZRNUFH7YQUV","created_at":"2026-07-05T11:42:34Z"},{"alias_kind":"pith_short_8","alias_value":"YNBPIZRN","created_at":"2026-07-05T11:42:34Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:YNBPIZRNUFH7YQUVPX2PNYRVHH","target":"record","payload":{"canonical_record":{"source":{"id":"2507.17324","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-07-23T08:45:53Z","cross_cats_sorted":[],"title_canon_sha256":"a1b587ec420a068c0aa8f53104e06c5ba6fd27480ace5721dc8eed3c26be2976","abstract_canon_sha256":"81e4f021cc9de29cf4e37ce95c21a5c7b0faac273f3940a02c9cc62a9e094957"},"schema_version":"1.0"},"canonical_sha256":"c342f4662da14ffc42957df4f6e23539f7e6b4a16c5ee69b2298ed3b763cfaf9","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:42:34.021064Z","signature_b64":"NaABrqc29dZQUdKz8DPRWDQWBLMh6tZL6zkyfPFcX9hBLRv9fQIv6T32jVL1A1w94EeTUAungnxB+U9HJIimDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c342f4662da14ffc42957df4f6e23539f7e6b4a16c5ee69b2298ed3b763cfaf9","last_reissued_at":"2026-07-05T11:42:34.020621Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:42:34.020621Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2507.17324","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:42:34Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"KNYTrXKOlbrzxI1UK+hhMPFlZjmh3qHyQtxogEg/wGZunfKp+ZHdITpOqb0/zdHD4RYLts1IIm8o+oI6QdviCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-13T02:35:52.383991Z"},"content_sha256":"c726c42ac051c79130278d8d3e7b8de08965d0b432f29c4b02d879745514af69","schema_version":"1.0","event_id":"sha256:c726c42ac051c79130278d8d3e7b8de08965d0b432f29c4b02d879745514af69"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:YNBPIZRNUFH7YQUVPX2PNYRVHH","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"An Empirical Study on Virtual Reality Software Security Weaknesses","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Feng Liu, Huashan Chen, Jinfu Chen, Junyi Wang, Pengfei Hu, Sen He, Yifan Xu, Zhenyu Qi","submitted_at":"2025-07-23T08:45:53Z","abstract_excerpt":"Virtual Reality (VR) has emerged as a transformative technology across industries, yet its security weaknesses, including vulnerabilities, are underinvestigated. This study investigates 334 VR projects hosted on GitHub, examining 1,681 software security weaknesses to understand: what types of weaknesses are prevalent in VR software; when and how weaknesses are introduced; how long they have survived; and how they have been removed. Due to the limited availability of VR software security weaknesses in public databases (e.g., the National Vulnerability Database or NVD), we prepare the first syst"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.17324","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2507.17324/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:42:34Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"il8y2lLauLh4Tk0A2SSjEQApZ8oox0cvEbDSU5YnhZHHGX8W+AmeON9YghJa0KC6T9ik25no4tFU//cfIfYwAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-13T02:35:52.384538Z"},"content_sha256":"66c6d4d693ba38e7d5d8f51ed2af29d9d093752636a629afc0f6808d45cefff5","schema_version":"1.0","event_id":"sha256:66c6d4d693ba38e7d5d8f51ed2af29d9d093752636a629afc0f6808d45cefff5"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/YNBPIZRNUFH7YQUVPX2PNYRVHH/bundle.json","state_url":"https://pith.science/pith/YNBPIZRNUFH7YQUVPX2PNYRVHH/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/YNBPIZRNUFH7YQUVPX2PNYRVHH/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-13T02:35:52Z","links":{"resolver":"https://pith.science/pith/YNBPIZRNUFH7YQUVPX2PNYRVHH","bundle":"https://pith.science/pith/YNBPIZRNUFH7YQUVPX2PNYRVHH/bundle.json","state":"https://pith.science/pith/YNBPIZRNUFH7YQUVPX2PNYRVHH/state.json","well_known_bundle":"https://pith.science/.well-known/pith/YNBPIZRNUFH7YQUVPX2PNYRVHH/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:YNBPIZRNUFH7YQUVPX2PNYRVHH","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"81e4f021cc9de29cf4e37ce95c21a5c7b0faac273f3940a02c9cc62a9e094957","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-07-23T08:45:53Z","title_canon_sha256":"a1b587ec420a068c0aa8f53104e06c5ba6fd27480ace5721dc8eed3c26be2976"},"schema_version":"1.0","source":{"id":"2507.17324","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.17324","created_at":"2026-07-05T11:42:34Z"},{"alias_kind":"arxiv_version","alias_value":"2507.17324v2","created_at":"2026-07-05T11:42:34Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.17324","created_at":"2026-07-05T11:42:34Z"},{"alias_kind":"pith_short_12","alias_value":"YNBPIZRNUFH7","created_at":"2026-07-05T11:42:34Z"},{"alias_kind":"pith_short_16","alias_value":"YNBPIZRNUFH7YQUV","created_at":"2026-07-05T11:42:34Z"},{"alias_kind":"pith_short_8","alias_value":"YNBPIZRN","created_at":"2026-07-05T11:42:34Z"}],"graph_snapshots":[{"event_id":"sha256:66c6d4d693ba38e7d5d8f51ed2af29d9d093752636a629afc0f6808d45cefff5","target":"graph","created_at":"2026-07-05T11:42:34Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2507.17324/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Virtual Reality (VR) has emerged as a transformative technology across industries, yet its security weaknesses, including vulnerabilities, are underinvestigated. This study investigates 334 VR projects hosted on GitHub, examining 1,681 software security weaknesses to understand: what types of weaknesses are prevalent in VR software; when and how weaknesses are introduced; how long they have survived; and how they have been removed. Due to the limited availability of VR software security weaknesses in public databases (e.g., the National Vulnerability Database or NVD), we prepare the first syst","authors_text":"Feng Liu, Huashan Chen, Jinfu Chen, Junyi Wang, Pengfei Hu, Sen He, Yifan Xu, Zhenyu Qi","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-07-23T08:45:53Z","title":"An Empirical Study on Virtual Reality Software Security Weaknesses"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.17324","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c726c42ac051c79130278d8d3e7b8de08965d0b432f29c4b02d879745514af69","target":"record","created_at":"2026-07-05T11:42:34Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"81e4f021cc9de29cf4e37ce95c21a5c7b0faac273f3940a02c9cc62a9e094957","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-07-23T08:45:53Z","title_canon_sha256":"a1b587ec420a068c0aa8f53104e06c5ba6fd27480ace5721dc8eed3c26be2976"},"schema_version":"1.0","source":{"id":"2507.17324","kind":"arxiv","version":2}},"canonical_sha256":"c342f4662da14ffc42957df4f6e23539f7e6b4a16c5ee69b2298ed3b763cfaf9","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"c342f4662da14ffc42957df4f6e23539f7e6b4a16c5ee69b2298ed3b763cfaf9","first_computed_at":"2026-07-05T11:42:34.020621Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:42:34.020621Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"NaABrqc29dZQUdKz8DPRWDQWBLMh6tZL6zkyfPFcX9hBLRv9fQIv6T32jVL1A1w94EeTUAungnxB+U9HJIimDw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:42:34.021064Z","signed_message":"canonical_sha256_bytes"},"source_id":"2507.17324","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c726c42ac051c79130278d8d3e7b8de08965d0b432f29c4b02d879745514af69","sha256:66c6d4d693ba38e7d5d8f51ed2af29d9d093752636a629afc0f6808d45cefff5"],"state_sha256":"82bc26df1570feeba3f5c17152c155a71dcbc8c812aa4e434c56adb1f7aabad8"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"9lZscujxg/uSFnvQnka9MPn8P15qDlKpsdoIuw4rDdNpOEhefFWPC7wC8/KV/PNPQJ0Qy+tOMVq4LvwozveECg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-13T02:35:52.397573Z","bundle_sha256":"b462f959ec6b8ae93cd627daabec75b873e194170b7a3b5c5a4aca43b29b3d8a"}}