{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T11:55:03Z","timestamp":1791460503445,"version":"4.3.4"},"publisher-location":"New York, NY, USA","reference-count":34,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,10,24]],"date-time":"2024-10-24T00:00:00Z","timestamp":1729728000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,10,24]]},"DOI":"10.1145\/3674805.3690750","type":"proceedings-article","created":{"date-parts":[[2024,10,15]],"date-time":"2024-10-15T18:39:24Z","timestamp":1729017564000},"page":"454-460","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["Do Developers Use Static Application Security Testing (SAST) Tools Straight Out of the Box? A large-scale Empirical Study"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7592-7079","authenticated-orcid":false,"given":"Gareth","family":"Bennett","sequence":"first","affiliation":[{"name":"Lancaster University, United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2728-9014","authenticated-orcid":false,"given":"Tracy","family":"Hall","sequence":"additional","affiliation":[{"name":"Lancaster University, United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2939-8919","authenticated-orcid":false,"given":"Steve","family":"Counsell","sequence":"additional","affiliation":[{"name":"Brunel University, United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3314-7300","authenticated-orcid":false,"given":"Emily","family":"Winter","sequence":"additional","affiliation":[{"name":"Lancaster University, United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1890-3390","authenticated-orcid":false,"given":"Thomas","family":"Shippey","sequence":"additional","affiliation":[{"name":"LogicMonitor, United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,10,24]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2017. CVE-2017-0144. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-0144. Accessed: 2024-06-06."},{"key":"e_1_3_2_1_2_1","unstructured":"2021. CVE-2021-44228. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-44228. Accessed: 2024-06-06."},{"key":"e_1_3_2_1_3_1","unstructured":"2023. Developer Survey. https:\/\/survey.stackoverflow.co\/2023\/. Accessed: 2024-06-04."},{"key":"e_1_3_2_1_4_1","unstructured":"2024. Prolific. https:\/\/www.prolific.com\/. Accessed: 2024-06-04."},{"key":"e_1_3_2_1_5_1","unstructured":"2024. Qualtrics XM. https:\/\/www.qualtrics.com. Accessed: 2024-06-06."},{"key":"e_1_3_2_1_6_1","volume-title":"Understanding Industry Perspectives of Static Analysis based Security Testing. arXiv preprint arXiv:2307.16325","author":"Ami Amit\u00a0Seal","year":"2023","unstructured":"Amit\u00a0Seal Ami, Kevin Moran, Denys Poshyvanyk, and Adwait Nadkarni. 2023. \" False negative\u2013that one is going to kill you\": Understanding Industry Perspectives of Static Analysis based Security Testing. arXiv preprint arXiv:2307.16325 (2023)."},{"key":"e_1_3_2_1_7_1","unstructured":"Anon. 2024. Do Developers Use Static Application Security Testing (SAST) Tools Straight Out of the Box? A large-scale Empirical Study. https:\/\/zenodo.org\/records\/11488719. Accessed: 2024-06-05."},{"key":"e_1_3_2_1_8_1","unstructured":"Aman Anupam Prathika Gonchigar Shashank Sharma Prapulla SB and Anala MR. 2020. Analysis of Open Source Node. js Vulnerability Scanners. International Research Journal of Engineering and Technology (IRJET) e-ISSN (2020) 2395\u20130056."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/SYNASC.2017.00035"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/SANER.2016.105"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3661167.3661262"},{"key":"e_1_3_2_1_12_1","unstructured":"Paul\u00a0E Black Damien Cupif Guillaume Haben Alex-Kevin Loembe Vadim Okun and Yann Prono. 2023. SATE VI Report. (2023)."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/2970276.2970347"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3475716.3475781"},{"key":"e_1_3_2_1_15_1","volume-title":"Do you really code? Designing and Evaluating Screening Questions for Online Surveys with Programmers. CoRR abs\/2103.04429","author":"Danilova Anastasia","year":"2021","unstructured":"Anastasia Danilova, Alena Naiakshina, Stefan Horstmann, and Matthew Smith. 2021. Do you really code? Designing and Evaluating Screening Questions for Online Surveys with Programmers. CoRR abs\/2103.04429 (2021). arxiv:2103.04429https:\/\/arxiv.org\/abs\/2103.04429"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.500-326"},{"key":"e_1_3_2_1_17_1","first-page":"835","article-title":"Why do software developers use static analysis tools? a user-centered study of developer needs and motivations","volume":"48","author":"Nguyen\u00a0Quang Do Lisa","year":"2020","unstructured":"Lisa Nguyen\u00a0Quang Do, James\u00a0R Wright, and Karim Ali. 2020. Why do software developers use static analysis tools? a user-centered study of developer needs and motivations. IEEE Transactions on Software Engineering 48, 3 (2020), 835\u2013847.","journal-title":"IEEE Transactions on Software Engineering"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-022-10179-6"},{"key":"e_1_3_2_1_19_1","unstructured":"Christoph Gentsch. 2020. Evaluation of open source static analysis security testing (SAST) tools for c. (2020)."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2019.00049"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2013.6606613"},{"key":"e_1_3_2_1_22_1","unstructured":"Mark Kasunic. 2005. Designing an effective survey."},{"key":"e_1_3_2_1_23_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Kaur Harjot","year":"2022","unstructured":"Harjot Kaur, Sabrina Amft, Daniel Votipka, Yasemin Acar, and Sascha Fahl. 2022. Where to recruit for security development studies: Comparing six software developer samples. In 31st USENIX Security Symposium (USENIX Security 22). 4041\u20134058."},{"key":"e_1_3_2_1_24_1","unstructured":"Kaixuan Li Sen Chen Lingling Fan Ruitao Feng Han Liu Chengwei Liu Yang Liu and Yixiang Chen. 2023. Comparison and Evaluation on Static Application Security Testing (SAST) Tools for Java. (2023)."},{"key":"e_1_3_2_1_25_1","volume-title":"Guidelines for conducting surveys in software engineering v. 1.1","author":"Linaker Johan","year":"2015","unstructured":"Johan Linaker, Sardar\u00a0Muhammad Sulaman, Martin H\u00f6st, and Rafael\u00a0Maiani de Mello. 2015. Guidelines for conducting surveys in software engineering v. 1.1. Lund University 50 (2015)."},{"key":"e_1_3_2_1_26_1","volume-title":"Evaluation of static analysis tools for finding vulnerabilities in Java and C\/C++ source code. arXiv preprint arXiv:1805.09040","author":"Mahmood Rahma","year":"2018","unstructured":"Rahma Mahmood and Qusay\u00a0H Mahmoud. 2018. Evaluation of static analysis tools for finding vulnerabilities in Java and C\/C++ source code. arXiv preprint arXiv:1805.09040 (2018)."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.3390\/app10249119"},{"key":"e_1_3_2_1_28_1","volume-title":"The chi-square test of independence. Biochemia medica 23, 2","author":"McHugh L","year":"2013","unstructured":"Mary\u00a0L McHugh. 2013. The chi-square test of independence. Biochemia medica 23, 2 (2013), 143\u2013149."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1007\/s00607-018-0664-z"},{"key":"e_1_3_2_1_30_1","volume-title":"Software Engineering User Study Recruitment on Prolific: An Experience Report. CoRR abs\/2201.05348","author":"Reid Brittany","year":"2022","unstructured":"Brittany Reid, Markus Wagner, Marcelo d\u2019Amorim, and Christoph Treude. 2022. Software Engineering User Study Recruitment on Prolific: An Experience Report. CoRR abs\/2201.05348 (2022). arxiv:2201.05348https:\/\/arxiv.org\/abs\/2201.05348"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-019-09750-5"},{"key":"e_1_3_2_1_32_1","volume-title":"Challenges in survey research. Contemporary Empirical Methods in Software Engineering","author":"Wagner Stefan","year":"2020","unstructured":"Stefan Wagner, Daniel Mendez, Michael Felderer, Daniel Graziotin, and Marcos Kalinowski. 2020. Challenges in survey research. Contemporary Empirical Methods in Software Engineering (2020), 93\u2013125."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2022.3152089"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2017.2"}],"event":{"name":"ESEM '24: ACM \/ IEEE International Symposium on Empirical Software Engineering and Measurement","location":"Barcelona Spain","acronym":"ESEM '24","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 18th ACM\/IEEE International Symposium on Empirical Software Engineering and Measurement"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3674805.3690750","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3674805.3690750","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T12:58:44Z","timestamp":1755867524000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3674805.3690750"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10,24]]},"references-count":34,"alternative-id":["10.1145\/3674805.3690750","10.1145\/3674805"],"URL":"https:\/\/doi.org\/10.1145\/3674805.3690750","relation":{},"subject":[],"published":{"date-parts":[[2024,10,24]]},"assertion":[{"value":"2024-10-24","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}