{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T05:01:15Z","timestamp":1785474075191,"version":"3.56.0"},"reference-count":81,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"United States Department of Education"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1109\/eurosp68448.2026.00058","type":"proceedings-article","created":{"date-parts":[[2026,7,30]],"date-time":"2026-07-30T19:10:00Z","timestamp":1785438600000},"page":"820-835","source":"Crossref","is-referenced-by-count":0,"title":["SourceFabric: Consistent and Scalable Security Policies for Git Repositories"],"prefix":"10.1109","author":[{"given":"Aditya Sirish A","family":"Yelgundhalli","sequence":"first","affiliation":[{"name":"Bloomberg and New York University","place":["New York, NY, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Patrick","family":"Zielinski","sequence":"additional","affiliation":[{"name":"New York University","place":["New York, NY, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Marcela S.","family":"Melara","sequence":"additional","affiliation":[{"name":"Intel Corporation","place":["Hillsboro, OR, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dennis","family":"Roellke","sequence":"additional","affiliation":[{"name":"Bloomberg","place":["New York, NY, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Reza","family":"Curtmola","sequence":"additional","affiliation":[{"name":"New Jersey Institute of Technology","place":["Newark, NJ, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Justin","family":"Cappos","sequence":"additional","affiliation":[{"name":"New York University","place":["New York, NY, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"How Palantir Secures Source Control"},{"key":"ref2","article-title":"Towards true continuous integration: distributed repositories and dependencies","author":"McGarr"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3328433.3328435"},{"key":"ref4","article-title":"Intel"},{"key":"ref5","article-title":"Microsoft"},{"key":"ref6","article-title":"Google"},{"key":"ref7","article-title":"International business machines"},{"key":"ref8","article-title":"Datadog inc"},{"key":"ref9","article-title":"Adobe, inc"},{"key":"ref10","article-title":"Powering Innovation and Speed with Amazon\u2019s Two-Pizza Teams","author":"Slater"},{"key":"ref11","article-title":"Git"},{"key":"ref12","article-title":"2022 Developer Survey - Version Control","year":"2022"},{"key":"ref13","article-title":"Over 170k users affected by attack using fake python infrastructure","year":"2024"},{"key":"ref14","article-title":"An attempt to backdoor the kernel","author":"Corbet","year":"2003"},{"key":"ref15","article-title":"Hacking rails\/rails repo","author":"Homakov","year":"2012"},{"key":"ref16","article-title":"Savannah and www.gnu.org downtime","year":"2010"},{"key":"ref17","article-title":"php.internals: Changes to Git commit workflow","author":"Popov"},{"key":"ref18","article-title":"Project: Infrastructure\/Incident reports\/2018-06-28 Github","year":"2018"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978395"},{"key":"ref20","article-title":"GitHub"},{"key":"ref21","article-title":"GitLab"},{"key":"ref22","article-title":"Bitbucket"},{"key":"ref23","article-title":"gittuf"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.241008"},{"key":"ref25","article-title":"PCI Data Security Standard (DSS)"},{"key":"ref26","article-title":"EU Cyber Resilience Act","year":"2024"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.6028\/nist.sp.800-218"},{"key":"ref28","article-title":"SLSA: Suppy-chain levels for software artifacts"},{"key":"ref29","article-title":"Source Code Management Platform Configuration Best Practices","year":"2023"},{"key":"ref30","article-title":"About organizations"},{"key":"ref31","article-title":"Groups"},{"key":"ref32","article-title":"What is a workspace?"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243794"},{"issue":"1","key":"ref34","first-page":"51","article-title":"Human error: an overlooked but significant information security problem","volume-title":"Computers & Security","volume":"12","author":"Wood","year":"1993"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3715340.3715439"},{"key":"ref36","article-title":"A05:2021 \u2013 Security Misconfiguration","year":"2021"},{"key":"ref37","article-title":"Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach"},{"key":"ref38","article-title":"Settlement reached with Target following major consumer data breach"},{"key":"ref39","article-title":"Open Source Security Foundation (OpenSSF)"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4842-0076-6"},{"key":"ref41","article-title":"Checking out pull requests locally"},{"key":"ref42","article-title":"Git Notes"},{"key":"ref43","article-title":"The refs\/for namespace"},{"key":"ref44","article-title":"git-appraise: Distributed code review for Git"},{"key":"ref45","article-title":"git-bug: Distributed, offline-first bug tracker embedded in Git, with bridges","author":"Mur\u00e9"},{"key":"ref46","article-title":"Best Practices Badge Program"},{"key":"ref47","first-page":"379","article-title":"On omitting commits and committing omissions: Preventing git metadata tampering that (re)introduces software vulnerabilities","volume-title":"25th USENIX Security Symposium (USENIX Security 16)","author":"Torres-Arias"},{"key":"ref48","article-title":"Open Source Project Security Baseline"},{"key":"ref49","article-title":"National Institute of Standards and Technology (NIST)"},{"key":"ref50","article-title":"Internet Engineering Task Force (IETF)"},{"key":"ref51","article-title":"Cloud Native Computing Foundation (CNCF)"},{"key":"ref52","article-title":"Open Worldwide Application Security Project (OWASP)"},{"key":"ref53","article-title":"Vendoring","author":"Gross","year":"2025"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866315"},{"key":"ref55","article-title":"gittuf source code - v0.11.0"},{"key":"ref56","article-title":"curl source code - v8.14.1"},{"key":"ref57","article-title":"Git Source Code Mirror - v2.50.0"},{"key":"ref58","article-title":"External Repository Staging Area"},{"key":"ref59","article-title":"Rest api endpoints for rules"},{"key":"ref60","article-title":"Project push rules api"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/3560835.3564549"},{"key":"ref62","article-title":"Git tools - submodules"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23184"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-22312-0_25"},{"key":"ref65","article-title":"Software Configuration Management (SCM) Security","author":"Wheeler","year":"2015"},{"issue":"1","key":"ref66","article-title":"Building a secure software supply chain with GNU Guix","volume-title":"The Art, Science, and Engineering of Programming","volume":"7","author":"Court\u00e8s","year":"2022"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3251365"},{"key":"ref68","first-page":"104103","article-title":"Enforcing cryptographic distributed-vcs access control with no trust on servers","volume-title":"Journal of Information Security and Applications","volume":"93","author":"Xu","year":"2025"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/504909.504910"},{"key":"ref70","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-319-15618-7_15","article-title":"Improving reuse of attribute-based access control policies using policy templates","volume-title":"Engineering Secure Software and Systems","author":"Decat","year":"2015"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-88625-9_14"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/2019599.2019604"},{"key":"ref73","article-title":"Supply Chain Integrity, Transparency, and Trust (SCITT)"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/3560835.3564556"},{"key":"ref75","first-page":"1393","article-title":"in-toto: Providing farm-to-table guarantees for bits and bytes","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Torres-Arias"},{"key":"ref76","first-page":"567","article-title":"Diplomat: Using delegations to protect community repositories","volume-title":"13th USENIX Symposium on Networked Systems Design and Implementation (NSDI 16)","author":"Kuppusamy"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560596"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.14722\/vehiclesec.2024.23015"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623200"},{"key":"ref80","first-page":"1","article-title":"Uptane: Securing software updates for automobiles","volume-title":"International Conference on Embedded Security in Car","author":"Kuppusamy"},{"key":"ref81","article-title":"in-toto Attestation Framework"}],"event":{"name":"2026 IEEE 11th European Symposium on Security and Privacy (EuroS&P)","location":"Lisbon, Portugal","start":{"date-parts":[[2026,7,6]]},"end":{"date-parts":[[2026,7,10]]}},"container-title":["2026 IEEE 11th European Symposium on Security and Privacy (EuroS&P)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11624144\/11623655\/11624249.pdf?arnumber=11624249","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T04:53:23Z","timestamp":1785473603000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11624249\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":81,"URL":"https:\/\/doi.org\/10.1109\/eurosp68448.2026.00058","relation":{},"subject":[],"published":{"date-parts":[[2026,7]]}}}