{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,22]],"date-time":"2026-07-22T11:04:55Z","timestamp":1784718295908,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":45,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,7,26]]},"DOI":"10.1145\/3785462.3815811","type":"proceedings-article","created":{"date-parts":[[2026,7,22]],"date-time":"2026-07-22T10:41:43Z","timestamp":1784716903000},"page":"1-8","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Enumerating Security Weaknesses in Public Research Software Repositories"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3145-6468","authenticated-orcid":false,"given":"Matthew","family":"Armstrong","sequence":"first","affiliation":[{"name":"Computer Science, University of Alabama, Tuscaloosa, AL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7824-9151","authenticated-orcid":false,"given":"Jeffrey C.","family":"Carver","sequence":"additional","affiliation":[{"name":"Computer Science, University of Alabama, Tuscaloosa, AL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1701-0008","authenticated-orcid":false,"given":"Reed","family":"Milewicz","sequence":"additional","affiliation":[{"name":"Department of Software Engineering and Research, Sandia National Laboratories, Albuquerque, NM, NM, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,7,26]]},"reference":[{"key":"e_1_3_3_2_2_2","doi-asserted-by":"publisher","unstructured":"Albert Bandura. 1993. Perceived Self-Efficacy in Cognitive Development and Functioning. Educational Psychologist 28 2 (1993) 117\u2013148. 10.1207\/s15326985ep2802_3","DOI":"10.1207\/s15326985ep2802_3"},{"key":"e_1_3_3_2_3_2","unstructured":"Robert Baxter Neil\u00a0Chue Hong Dirk Gorissen James Hetherington and Ilian Todorov. 2012. The research software engineer."},{"key":"e_1_3_3_2_4_2","unstructured":"BBC. 2020. Europe\u2019s supercomputers hijacked by attackers for crypto mining. https:\/\/www.bbc.com\/news\/technology-52709660. Accessed: 2025-17-04."},{"key":"e_1_3_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCSA.2013.22"},{"key":"e_1_3_3_2_6_2","unstructured":"CISA. 2022. APT Groups Target Healthcare and Essential Services. https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa20-126a. Accessed: 2025-17-04."},{"key":"e_1_3_3_2_7_2","doi-asserted-by":"publisher","unstructured":"Ian\u00a0A. Cosden Kenton McHenry and Daniel\u00a0S. Katz. 2022. Research Software Engineers: Career Entry Points and Training Gaps. Computing in Science & Engineering 24 6 (2022) 14\u201321. 10.1109\/MCSE.2023.3258630","DOI":"10.1109\/MCSE.2023.3258630"},{"key":"e_1_3_3_2_8_2","doi-asserted-by":"crossref","unstructured":"Anshu Dubey. 2022. Good Practices for High-Quality Scientific Computing. Computing in Science & Engineering 24 6 (2022) 72\u201376.","DOI":"10.1109\/MCSE.2023.3259259"},{"key":"e_1_3_3_2_9_2","doi-asserted-by":"publisher","unstructured":"Michael Felderer Michael Goedicke Lars Grunske Wilhelm Hasselbring Anna-Lena Lamprecht and Bernhard Rumpe. 2025. Investigating Research Software Engineering: Toward RSE Research. Commun. ACM 68 2 (Jan. 2025) 20\u201323. 10.1145\/3685265","DOI":"10.1145\/3685265"},{"key":"e_1_3_3_2_10_2","unstructured":"Github. 2025. About secret scanning. https:\/\/docs.github.com\/en\/code-security\/secret-scanning\/introduction\/about-secret-scanning. Accessed: 2025-10-21."},{"key":"e_1_3_3_2_11_2","doi-asserted-by":"publisher","unstructured":"Carole Goble. 2014. Better Software Better Research. IEEE Internet Computing 18 5 (2014) 4\u20138. 10.1109\/MIC.2014.88","DOI":"10.1109\/MIC.2014.88"},{"key":"e_1_3_3_2_12_2","doi-asserted-by":"crossref","unstructured":"A Grannan Kanika Sood Boyana Norris and Anshu Dubey. 2020. Understanding the landscape of scientific software used on high-performance computing platforms. The International Journal of High Performance Computing Applications 34 4 (2020) 465\u2013477.","DOI":"10.1177\/1094342019899451"},{"key":"e_1_3_3_2_13_2","doi-asserted-by":"crossref","unstructured":"Wilhelm Hasselbring Leslie Carr Simon Hettrick Heather Packer and Thanassis Tiropanis. 2020. Open source research software. Computer 53 8 (2020) 84\u201388.","DOI":"10.1109\/MC.2020.2998235"},{"key":"e_1_3_3_2_14_2","unstructured":"Michael Henriksen. 2023. gitrob. https:\/\/github.com\/michenriksen\/gitrob. Accessed: 2025-10-23."},{"key":"e_1_3_3_2_15_2","unstructured":"Software\u00a0Sustainability Institute. 2025. Organizational Membership. https:\/\/www.software.ac.uk\/about\/research-software-engineers. Accessed: 2025-02-10."},{"key":"e_1_3_3_2_16_2","first-page":"1","volume-title":"CEUR Workshop Proceedings","volume":"3921","author":"Islam Aminul\u00a0Didar","year":"2025","unstructured":"Aminul\u00a0Didar Islam and Slinger Jansen. 2025. Securing Software Ecosystems through Repository Mining. In CEUR Workshop Proceedings , Vol.\u00a03921. CEUR WS, CEUR, Utrecht, The Netherlands, 1\u20138."},{"key":"e_1_3_3_2_17_2","doi-asserted-by":"crossref","unstructured":"Daniel\u00a0S Katz Morane Gruenpeter and Tom Honeyman. 2021. Taking a fresh look at FAIR for research software. Patterns 2 3 (2021) 1\u20134.","DOI":"10.1016\/j.patter.2021.100222"},{"key":"e_1_3_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISI49825.2020.9280544"},{"key":"e_1_3_3_2_19_2","unstructured":"Joe Leon. 2024. How TruffleHog Verifies Secrets. https:\/\/trufflesecurity.com\/blog\/how-trufflehog-verifies-secrets. Accessed: 2025-10-14."},{"key":"e_1_3_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.23967\/coupled.2025.016"},{"key":"e_1_3_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23418"},{"key":"e_1_3_3_2_22_2","unstructured":"Reed Milewicz Jeffrey Carver Samuel Grayson and Travis Atkison. 2022. A Secure Future for Open-Source Computational Science and Engineering. arxiv:https:\/\/arXiv.org\/abs\/2211.06343"},{"key":"e_1_3_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1145\/3384217.3384218"},{"key":"e_1_3_3_2_24_2","unstructured":"Open Worldwide Application Security Project (OWASP). 2025. Awareness (Security). https:\/\/ot.owasp.org\/v\/2025\/appendix\/glossary\/. OWASP Operational Technology Top 10 Glossary."},{"key":"e_1_3_3_2_25_2","unstructured":"Open Worldwide Application Security Project (OWASP). 2025. OWASP Top Ten. https:\/\/owasp.org\/www-project-top-ten\/. Accessed: 2025-10-22."},{"key":"e_1_3_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICoDSE53690.2021.9648484"},{"key":"e_1_3_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639139"},{"key":"e_1_3_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1145\/2597073.2597117"},{"key":"e_1_3_3_2_29_2","unstructured":"Python Code Quality Authority. 2025. Bandit. https:\/\/github.com\/PyCQA\/bandit."},{"key":"e_1_3_3_2_30_2","first-page":"208","volume-title":"2019 9th International Conference on Cloud Computing, Data Science & Engineering (Confluence)","author":"Sangwan Om\u00a0Prakash","year":"2019","unstructured":"Om\u00a0Prakash Sangwan et\u00a0al. 2019. Review of text mining techniques for software bug localization. In 2019 9th International Conference on Cloud Computing, Data Science & Engineering (Confluence). IEEE, IEEE, Noida, Uttar Pradesh, 208\u2013211."},{"key":"e_1_3_3_2_31_2","unstructured":"RSE Society. 2025. International RSE communities. https:\/\/society-rse.org\/international-rse-organisations\/. Accessed: 2025-02-12."},{"key":"e_1_3_3_2_32_2","doi-asserted-by":"publisher","unstructured":"Addi\u00a0Malviya Thakur Reed Milewicz Mahmoud Jahanshahi Lav\u00ednia Paganini Bogdan Vasilescu and Audris Mockus. 2025. Scientific Open-Source Software Is Less Likely to Become Abandoned Than One Might Think! Lessons from Curating a Catalog of Maintained Scientific Software. Proceedings of the ACM on Software Engineering 2 FSE (June 2025) 2216\u20132239. 10.1145\/3729369","DOI":"10.1145\/3729369"},{"key":"e_1_3_3_2_33_2","unstructured":"The MITRE Corporation. 2025. 2025 CWE Top 25 Most Dangerous Software Weaknesses. https:\/\/cwe.mitre.org\/top25\/archive\/2025\/2025_cwe_top25.html. Accessed: 2026-02-07."},{"key":"e_1_3_3_2_34_2","unstructured":"The MITRE Corporation. 2025. 2025 \u201cOn the Cusp\u201d \u2013 Other Dangerous Software Weaknesses. https:\/\/cwe.mitre.org\/top25\/archive\/2025\/2025_onthecusp_list.html. Accessed: 2026-02-07."},{"key":"e_1_3_3_2_35_2","unstructured":"The MITRE Corporation. 2025. About CWE. https:\/\/cwe.mitre.org\/about\/index.html. Accessed: 2025-10-23."},{"key":"e_1_3_3_2_36_2","unstructured":"The MITRE Corporation. 2025. CWE Glossary. https:\/\/cwe.mitre.org\/documents\/glossary\/index.html. Accessed: 2025-10-23."},{"key":"e_1_3_3_2_37_2","unstructured":"The MITRE Corporation. 2025. CWE List Version 4.19.1. https:\/\/cwe.mitre.org\/data\/index.html. Accessed: 2026-02-07."},{"key":"e_1_3_3_2_38_2","unstructured":"The MITRE Corporation. 2025. CWE VIEW: Comprehensive Categorization for Software Assurance Trends. https:\/\/cwe.mitre.org\/data\/definitions\/1400.html. Accessed: 2026-02-07."},{"key":"e_1_3_3_2_39_2","unstructured":"The MITRE Corporation. 2025. New to CWE. https:\/\/cwe.mitre.org\/about\/new_to_cwe.html. Accessed: 2025-10-23."},{"key":"e_1_3_3_2_40_2","doi-asserted-by":"crossref","unstructured":"Ron Torten Carmen Reaiche and Stephen Boyle. 2018. The impact of security awareness on information technology professionals\u2019 behavior. Computers & Security 79 (2018) 68\u201379.","DOI":"10.1016\/j.cose.2018.08.007"},{"key":"e_1_3_3_2_41_2","unstructured":"Truffle Security. 2025. Trufflehog. https:\/\/github.com\/trufflesecurity\/trufflehog."},{"key":"e_1_3_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1145\/3313831.3376754"},{"key":"e_1_3_3_2_43_2","unstructured":"David Wheeler. 2025. Flawfinder. https:\/\/github.com\/david-a-wheeler\/flawfinder."},{"key":"e_1_3_3_2_44_2","doi-asserted-by":"crossref","unstructured":"Greg Wilson Jennifer Bryan Karen Cranston Justin Kitzes Lex Nederbragt and Tracy\u00a0K Teal. 2017. Good enough practices in scientific computing. PLoS computational biology 13 6 (2017) e1005510.","DOI":"10.1371\/journal.pcbi.1005510"},{"key":"e_1_3_3_2_45_2","doi-asserted-by":"crossref","unstructured":"Huiping Yan and Susan Yatabe. 2017. Case studies of nuclear research software development. CNL Nuclear Review 8 1 (2017) 35\u201351.","DOI":"10.12943\/CNR.2017.00013"},{"key":"e_1_3_3_2_46_2","doi-asserted-by":"crossref","unstructured":"Yue Zhang Justin Murphy and Akond Rahman. 2025. Come for syntax stay for speed write secure code: an empirical study of security weaknesses in Julia programs. Empirical Software Engineering 30 2 (2025) 58.","DOI":"10.1007\/s10664-024-10606-w"}],"event":{"name":"PEARC '26: Practice and Experience in Advanced Research Computing","location":"Minneapolis MN USA","acronym":"PEARC '26","sponsor":["SIGHPC ACM Special Interest Group on High Performance Computing, Special Interest Group on High Performance Computing","SIGAPP ACM Special Interest Group on Applied Computing"]},"container-title":["Proceedings of the Practice and Experience in Advanced Research Computing 2026: Resilient Roots + Empowered Communities"],"original-title":[],"deposited":{"date-parts":[[2026,7,22]],"date-time":"2026-07-22T10:45:23Z","timestamp":1784717123000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3785462.3815811"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,26]]},"references-count":45,"alternative-id":["10.1145\/3785462.3815811","10.1145\/3785462"],"URL":"https:\/\/doi.org\/10.1145\/3785462.3815811","relation":{},"subject":[],"published":{"date-parts":[[2026,7,26]]},"assertion":[{"value":"2026-07-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}