{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T11:01:14Z","timestamp":1785495674884,"version":"3.56.0"},"publisher-location":"New York, NY, USA","reference-count":87,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,4,13]],"date-time":"2026-04-13T00:00:00Z","timestamp":1776038400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100002913","name":"Vlaamse Overheid","doi-asserted-by":"publisher","award":["Cybersecurity Research Program Flanders"],"award-info":[{"award-number":["Cybersecurity Research Program Flanders"]}],"id":[{"id":"10.13039\/501100002913","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2312321"],"award-info":[{"award-number":["2312321"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000038","name":"Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","award":["N\/A"],"award-info":[{"award-number":["N\/A"]}],"id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001871","name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia","doi-asserted-by":"publisher","award":["UID\/50021\/2025"],"award-info":[{"award-number":["UID\/50021\/2025"]}],"id":[{"id":"10.13039\/501100001871","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001871","name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia","doi-asserted-by":"publisher","award":["UID\/PRR\/50021\/2025"],"award-info":[{"award-number":["UID\/PRR\/50021\/2025"]}],"id":[{"id":"10.13039\/501100001871","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001871","name":"Plano de Recupera\u00e7\u00e3o e Resili\u00eancia","doi-asserted-by":"publisher","award":["2024.07411.IACDC"],"award-info":[{"award-number":["2024.07411.IACDC"]}],"id":[{"id":"10.13039\/501100001871","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,4,13]]},"DOI":"10.1145\/3793302.3793355","type":"proceedings-article","created":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T10:42:54Z","timestamp":1785494574000},"page":"249-261","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["An Empirical Study of Policy as Code: Adoption, Purpose, and Maintenance"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0938-4843","authenticated-orcid":false,"given":"Ruben","family":"Opdebeeck","sequence":"first","affiliation":[{"name":"Vrije Universiteit Brussel, Brussels, Belgium"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2621-6104","authenticated-orcid":false,"given":"Mahmoud","family":"Alfadel","sequence":"additional","affiliation":[{"name":"University of Calgary, Calgary, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5056-757X","authenticated-orcid":false,"given":"Akond","family":"Rahman","sequence":"additional","affiliation":[{"name":"Auburn University, Auburn, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9633-7577","authenticated-orcid":false,"given":"Yutaro","family":"Kashiwa","sequence":"additional","affiliation":[{"name":"Nara Institute of Science and Technology, Nara, Japan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6612-9013","authenticated-orcid":false,"given":"Jo\u00e3o F.","family":"Ferreira","sequence":"additional","affiliation":[{"name":"INESC-ID and Faculty of Engineering, University of Porto, Porto, Portugal"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2324-0608","authenticated-orcid":false,"given":"Raula Gaikovina","family":"Kula","sequence":"additional","affiliation":[{"name":"The University of Osaka, Osaka, Japan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1710-1268","authenticated-orcid":false,"given":"Coen","family":"De Roover","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Brussel, Brussels, Belgium"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,7,31]]},"reference":[{"key":"e_1_3_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/3183519.3183549"},{"key":"e_1_3_3_2_3_2","doi-asserted-by":"crossref","unstructured":"Ahmad Alnafessah Alim\u00a0Ul Gias Runan Wang Lulai Zhu Giuliano Casale and Antonio Filieri. 2021. Quality-Aware DevOps Research: Where Do We Stand? IEEE Access 9 (2021) 44476\u201344489. doi:10.1109\/ACCESS.2021.3064867","DOI":"10.1109\/ACCESS.2021.3064867"},{"key":"e_1_3_3_2_4_2","first-page":"585","volume-title":"28th USENIX security symposium (USENIX security 19)","author":"Andow Benjamin","year":"2019","unstructured":"Benjamin Andow, Samin\u00a0Yaseer Mahmud, Wenyu Wang, Justin Whitaker, William Enck, Bradley Reaves, Kapil Singh, and Tao Xie. 2019. PolicyLint: investigating internal privacy policy contradictions on google play. In 28th USENIX security symposium (USENIX security 19). 585\u2013602."},{"key":"e_1_3_3_2_5_2","first-page":"985","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Andow Benjamin","year":"2020","unstructured":"Benjamin Andow, Samin\u00a0Yaseer Mahmud, Justin Whitaker, William Enck, Bradley Reaves, Kapil Singh, and Serge Egelman. 2020. Actions speak louder than words: Entity-Sensitive privacy policy and data flow analysis with PoliCheck. In 29th USENIX Security Symposium (USENIX Security 20). 985\u20131002."},{"key":"e_1_3_3_2_6_2","volume-title":"Constructing grounded theory (2nd ed.)","author":"Charmaz Kathy","year":"2014","unstructured":"Kathy Charmaz. 2014. Constructing grounded theory (2nd ed.). Sage."},{"key":"e_1_3_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSA-C54293.2022.00049"},{"key":"e_1_3_3_2_8_2","volume-title":"Sampling Techniques (3rd ed.)","author":"Cochran William\u00a0Gemmell","year":"1977","unstructured":"William\u00a0Gemmell Cochran. 1977. Sampling Techniques (3rd ed.). John Wiley & Sons."},{"key":"e_1_3_3_2_9_2","doi-asserted-by":"crossref","unstructured":"Jacob Cohen. 1960. A Coefficient of Agreement for Nominal Scales. Educational and Psychological Measurement 20 1 (1960) 37\u201346. doi:10.1177\/001316446002000104","DOI":"10.1177\/001316446002000104"},{"key":"e_1_3_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1145\/3419111.3421303"},{"key":"e_1_3_3_2_11_2","doi-asserted-by":"crossref","unstructured":"Stefano Dalla\u00a0Palma Dario Di\u00a0Nucci Fabio Palomba and Damian\u00a0Andrew Tamburri. 2020. Toward a catalog of software quality metrics for infrastructure code. Journal of Systems and Software 170 (2020) 110726.","DOI":"10.1016\/j.jss.2020.110726"},{"key":"e_1_3_3_2_12_2","doi-asserted-by":"crossref","unstructured":"Stefano Dalla\u00a0Palma Dario Di\u00a0Nucci Fabio Palomba and Damian\u00a0A. Tamburri. 2022. Within-Project Defect Prediction of Infrastructure-as-Code Using Product and Process Metrics. IEEE Transactions on Software Engineering 48 6 (2022) 2086\u20132104. doi:10.1109\/TSE.2021.3051492","DOI":"10.1109\/TSE.2021.3051492"},{"key":"e_1_3_3_2_13_2","doi-asserted-by":"crossref","unstructured":"Stefano Dalla\u00a0Palma Chiel van Asseldonk Gemma Catolino Dario Di\u00a0Nucci Fabio Palomba and Damian\u00a0A Tamburri. 2023. \u201cThrough the looking-glass...\" An Empirical Study on Blob Infrastructure Blueprints in TOSCA. Journal of Software: Evolution and Process (2023).","DOI":"10.1002\/smr.2533"},{"key":"e_1_3_3_2_14_2","doi-asserted-by":"crossref","unstructured":"Fred\u00a0D Davis RP Bagozzi and PR Warshaw. 1989. Technology acceptance model. J Manag Sci 35 8 (1989) 982\u20131003.","DOI":"10.1287\/mnsc.35.8.982"},{"key":"e_1_3_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/3177102.3177113"},{"key":"e_1_3_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1007\/11814771_51"},{"key":"e_1_3_3_2_17_2","doi-asserted-by":"crossref","unstructured":"Georgios-Petros Drosos Thodoris Sotiropoulos Georgios Alexopoulos Dimitris Mitropoulos and Zhendong Su. 2024. When Your Infrastructure Is a Buggy Program: Understanding Faults in Infrastructure as Code Ecosystems. Proc. ACM Program. Lang. 8 OOPSLA2 Article 359 (Oct. 2024) 31\u00a0pages. doi:10.1145\/3689799","DOI":"10.1145\/3689799"},{"key":"e_1_3_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598078"},{"key":"e_1_3_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510233"},{"key":"e_1_3_3_2_20_2","doi-asserted-by":"crossref","unstructured":"F.\u00a0M.\u00a0A. Erich C. Amrit and M. Daneva. 2017. A qualitative study of DevOps usage in practice. Journal of Software: Evolution and Process 29 6 (2017) e1885. doi:10.1002\/smr.1885","DOI":"10.1002\/smr.1885"},{"key":"e_1_3_3_2_21_2","doi-asserted-by":"crossref","unstructured":"Jill\u00a0J Francis Marie Johnston Clare Robertson Liz Glidewell Vikki Entwistle Martin\u00a0P Eccles and Jeremy\u00a0M Grimshaw. 2010. What is an adequate sample size? Operationalising data saturation for theory-based interview studies. Psychology and Health 25 10 (2010) 1229\u20131245.","DOI":"10.1080\/08870440903194015"},{"key":"e_1_3_3_2_22_2","doi-asserted-by":"crossref","unstructured":"Vahid Garousi Michael Felderer and Mika\u00a0V. M\u00e4ntyl\u00e4. 2019. Guidelines for including grey literature and conducting multivocal literature reviews in software engineering. Information and Software Technology 106 (2019) 101\u2013121. doi:10.1016\/j.infsof.2018.09.006","DOI":"10.1016\/j.infsof.2018.09.006"},{"key":"e_1_3_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2019.00092"},{"key":"e_1_3_3_2_24_2","doi-asserted-by":"crossref","unstructured":"Oliver Hanappi Waldemar Hummer and Schahram Dustdar. 2016. Asserting Reliable Convergence for Configuration Management Scripts. SIGPLAN Not. 51 10 (oct 2016) 328\u2013343. doi:10.1145\/3022671.2984000","DOI":"10.1145\/3022671.2984000"},{"key":"e_1_3_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICIC48496.2019.8966719"},{"key":"e_1_3_3_2_26_2","doi-asserted-by":"crossref","unstructured":"Md\u00a0Mahadi Hassan John Salvador Shubhra Kanti\u00a0Karmaker Santu and Akond Rahman. 2024. State Reconciliation Defects in Infrastructure as Code. Proc. ACM Softw. Eng. 1 FSE Article 83 (jul 2024) 24\u00a0pages. doi:10.1145\/3660790","DOI":"10.1145\/3660790"},{"key":"e_1_3_3_2_27_2","doi-asserted-by":"crossref","unstructured":"Gary Hickey and Cheryl Kipping. 1996. A multi-stage approach to the coding of data from open-ended questions. Nurse researcher 4 1 (1996) 81\u201391.","DOI":"10.7748\/nr.4.1.81.s9"},{"key":"e_1_3_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-45065-5_19"},{"key":"e_1_3_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1145\/2597073.2597074"},{"key":"e_1_3_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/REW53955.2021.00070"},{"key":"e_1_3_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/QRS51102.2020.00063"},{"key":"e_1_3_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1145\/3405962.3405979"},{"key":"e_1_3_3_2_33_2","doi-asserted-by":"crossref","unstructured":"J.\u00a0Richard Landis and Gary\u00a0G. Koch. 1977. The Measurement of Observer Agreement for Categorical Data. Biometrics 33 1 (1977) 159\u2013174.","DOI":"10.2307\/2529310"},{"key":"e_1_3_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-72013-1_6"},{"key":"e_1_3_3_2_35_2","doi-asserted-by":"crossref","unstructured":"Wei Li Borui Yang Hangyu Ye Liyao Xiang Qingxiao Tao Xinbing Wang and Chenghu Zhou. 2024. MiniTracker: Large-Scale Sensitive Information Tracking in Mini Apps. IEEE Transactions on Dependable and Secure Computing 21 4 (2024) 2099\u20132114. doi:10.1109\/TDSC.2023.3299945","DOI":"10.1109\/TDSC.2023.3299945"},{"key":"e_1_3_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427250"},{"key":"e_1_3_3_2_37_2","doi-asserted-by":"crossref","unstructured":"Xing Liu Jiqiang Liu Sencun Zhu Wei Wang and Xiangliang Zhang. 2019. Privacy risk analysis and mitigation of analytics libraries in the android ecosystem. IEEE Transactions on Mobile Computing 19 5 (2019) 1184\u20131199.","DOI":"10.1109\/TMC.2019.2903186"},{"key":"e_1_3_3_2_38_2","doi-asserted-by":"crossref","unstructured":"Kirsti Malterud. 1993. Shared Understanding of the Qualitative Research Process. Guidelines for the Medical Researcher. Family Practice 10 2 (07 1993) 201\u2013206. doi:10.1093\/fampra\/10.2.201","DOI":"10.1093\/fampra\/10.2.201"},{"key":"e_1_3_3_2_39_2","doi-asserted-by":"crossref","unstructured":"Davood Mazinanian Ameya Ketkar Nikolaos Tsantalis and Danny Dig. 2017. Understanding the use of lambda expressions in Java. Proc. ACM Program. Lang. 1 OOPSLA (2017) 85:1\u201385:31. doi:10.1145\/3133909","DOI":"10.1145\/3133909"},{"key":"e_1_3_3_2_40_2","doi-asserted-by":"crossref","unstructured":"Alok Mishra and Ziadoon Otaiwi. 2020. DevOps and software quality: A systematic mapping. Computer Science Review 38 (2020) 100308.","DOI":"10.1016\/j.cosrev.2020.100308"},{"key":"e_1_3_3_2_41_2","volume-title":"Infrastructure as Code: Managing Servers in the Cloud (1st ed.)","author":"Morris Kief","year":"2016","unstructured":"Kief Morris. 2016. Infrastructure as Code: Managing Servers in the Cloud (1st ed.). O\u2019Reilly."},{"key":"e_1_3_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/SANER64311.2025.00025"},{"key":"e_1_3_3_2_43_2","unstructured":"Ruben Opdebeeck Mahmoud Alfadel Akond Rahman Yutaro Kashiwa Joao Ferreira Raula\u00a0Gaikovina Kula and Coen\u00a0De Roover. 2026. Replication package for \"An Empirical Study of Policy-as-Code Technologies: Adoption Purpose and Maintenance\". https:\/\/doi.org\/10.6084\/m9.figshare.29586128. doi:10.6084\/m9.figshare.29586128[Online; accessed 20-Jan-2026]."},{"key":"e_1_3_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM67354.2025.00014"},{"key":"e_1_3_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.1145\/3524842.3527964"},{"key":"e_1_3_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSR59073.2023.00079"},{"key":"e_1_3_3_2_47_2","doi-asserted-by":"crossref","unstructured":"Ruben Opdebeeck Ahmed Zerouali Camilo Vel\u00e1zquez-Rodr\u00edguez and Coen De\u00a0Roover. 2021. On the Practice of Semantic Versioning for Ansible Galaxy Roles: An Empirical Study and a Change Classification Model. J. Syst. Softw. 182 C (dec 2021) 21\u00a0pages. doi:10.1016\/j.jss.2021.111059","DOI":"10.1016\/j.jss.2021.111059"},{"key":"e_1_3_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.1145\/3416505.3423563"},{"key":"e_1_3_3_2_49_2","doi-asserted-by":"crossref","unstructured":"Lisa Parker Tanya Karliychuk Donna Gillies Barbara Mintzes Melissa Raven and Quinn Grundy. 2017. A health app developer\u2019s guide to law and policy: a multi-sector policy analysis. BMC medical informatics and decision making 17 (2017) 1\u201313.","DOI":"10.1186\/s12911-017-0535-0"},{"key":"e_1_3_3_2_50_2","doi-asserted-by":"crossref","unstructured":"Ioannis Paspatis Aggeliki Tsohou and Spyros Kokolakis. 2020. AppAware: a policy visualization model for mobile applications. Information & Computer Security 28 1 (2020) 116\u2013132.","DOI":"10.1108\/ICS-04-2019-0049"},{"key":"e_1_3_3_2_51_2","doi-asserted-by":"crossref","unstructured":"Juanjo P\u00e9rez-S\u00e1nchez Saima Rafi Juan\u00a0Manuel Carrillo de Gea Joaqu\u00edn Nicol\u00e1s Ros and Jos\u00e9\u00a0Luis Fern\u00e1ndez Alem\u00e1n. 2025. A theory on human factors in DevOps adoption. Computer Standards and Interfaces 92 (2025) 103907. doi:10.1016\/j.csi.2024.103907","DOI":"10.1016\/j.csi.2024.103907"},{"key":"e_1_3_3_2_52_2","doi-asserted-by":"crossref","unstructured":"Giovanni Quattrocchi and Damian\u00a0Andrew Tamburri. 2022. Predictive maintenance of infrastructure code using \u201cfluid\u201d datasets: An exploratory study on Ansible defect proneness. Journal of Software: Evolution and Process 34 11 (2022) e2480. doi:10.1002\/smr.2480","DOI":"10.1002\/smr.2480"},{"key":"e_1_3_3_2_53_2","doi-asserted-by":"crossref","unstructured":"Akond Rahman Dibyendu\u00a0Brinto Bose Raunak Shakya and Rahul Pandita. 2023. Come for Syntax Stay for Speed Understand Defects: An Empirical Study of Defects in Julia Programs. Empirical Software Engineering 28 93 (2023) 33.","DOI":"10.1007\/s10664-023-10328-5"},{"key":"e_1_3_3_2_54_2","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380409"},{"key":"e_1_3_3_2_55_2","doi-asserted-by":"crossref","unstructured":"Akond Rahman Rezvan Mahdavi-Hezaveh and Laurie Williams. 2018. A systematic mapping study of infrastructure as code research. Information and Software Technology (2018). doi:10.1016\/j.infsof.2018.12.004","DOI":"10.1016\/j.infsof.2018.12.004"},{"key":"e_1_3_3_2_56_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00033"},{"key":"e_1_3_3_2_57_2","doi-asserted-by":"crossref","unstructured":"Akond Rahman Md\u00a0Rayhanur Rahman Chris Parnin and Laurie Williams. 2021. Security Smells in Ansible and Chef Scripts: A Replication Study. ACM Trans. Softw. Eng. Methodol. 30 1 Article 3 (Jan. 2021) 31\u00a0pages. doi:10.1145\/3408897","DOI":"10.1145\/3408897"},{"key":"e_1_3_3_2_58_2","doi-asserted-by":"crossref","unstructured":"Akond Rahman Shazibul\u00a0Islam Shamim Dibyendu\u00a0Brinto Bose and Rahul Pandita. 2023. Security Misconfigurations in Open Source Kubernetes Manifests: An Empirical Study. ACM Trans. Softw. Eng. Methodol. 32 4 Article 99 (May 2023) 36\u00a0pages. doi:10.1145\/3579639","DOI":"10.1145\/3579639"},{"key":"e_1_3_3_2_59_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2018.00014"},{"key":"e_1_3_3_2_60_2","doi-asserted-by":"crossref","unstructured":"Akond Rahman and Laurie Williams. 2019. Source code properties of defective infrastructure as code scripts. Information and Software Technology 112 (2019) 148 \u2013 163. doi:10.1016\/j.infsof.2019.04.013","DOI":"10.1016\/j.infsof.2019.04.013"},{"key":"e_1_3_3_2_61_2","doi-asserted-by":"publisher","DOI":"10.1109\/Agile.2015.12"},{"key":"e_1_3_3_2_62_2","doi-asserted-by":"publisher","DOI":"10.1145\/2898375.2898383"},{"key":"e_1_3_3_2_63_2","doi-asserted-by":"publisher","DOI":"10.1145\/2896941.2896946"},{"key":"e_1_3_3_2_64_2","volume-title":"Policy as Code (1st ed.)","author":"Ray Jimmy","year":"2024","unstructured":"Jimmy Ray. 2024. Policy as Code (1st ed.). O\u2019Reilly Media."},{"key":"e_1_3_3_2_65_2","volume-title":"Proceedings of the 37th IEEE\/ACM International Conference on Automated Software Engineering","author":"Reis Sofia","year":"2023","unstructured":"Sofia Reis, Rui Abreu, Marcelo d\u2019Amorim, and Daniel Fortunato. 2023. Leveraging Practitioners\u2019 Feedback to Improve a Security Linter. In Proceedings of the 37th IEEE\/ACM International Conference on Automated Software Engineering. ACM, Article 66, 12\u00a0pages. doi:10.1145\/3551349.3560419"},{"key":"e_1_3_3_2_66_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-49094-6_44"},{"key":"e_1_3_3_2_67_2","volume-title":"Proceedings of the 37th IEEE\/ACM International Conference on Automated Software Engineering","author":"Saavedra Nuno","year":"2023","unstructured":"Nuno Saavedra and Jo\u00e3o\u00a0F. Ferreira. 2023. GLITCH: Automated Polyglot Security Smell Detection in Infrastructure as Code. In Proceedings of the 37th IEEE\/ACM International Conference on Automated Software Engineering. ACM, Article 47, 12\u00a0pages. doi:10.1145\/3551349.3556945"},{"key":"e_1_3_3_2_68_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASE56229.2023.00162"},{"key":"e_1_3_3_2_69_2","volume-title":"The coding manual for qualitative researchers","author":"Salda\u00f1a Johnny","year":"2015","unstructured":"Johnny Salda\u00f1a. 2015. The coding manual for qualitative researchers. Sage."},{"key":"e_1_3_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.1109\/QUATIC.2018.00040"},{"key":"e_1_3_3_2_71_2","doi-asserted-by":"publisher","DOI":"10.1145\/2908080.2908083"},{"key":"e_1_3_3_2_72_2","doi-asserted-by":"publisher","DOI":"10.1145\/2901739.2901761"},{"key":"e_1_3_3_2_73_2","unstructured":"Parvaneh Shayegh Vijayanta Jain Amin Rabinia and Sepideh Ghanavati. 2019. Automated approach to improve iot privacy policies. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/1910.04133 (2019)."},{"key":"e_1_3_3_2_74_2","doi-asserted-by":"publisher","DOI":"10.1145\/2884781.2884855"},{"key":"e_1_3_3_2_75_2","doi-asserted-by":"crossref","unstructured":"Daniel Sokolowski David Spielmann and Guido Salvaneschi. 2024. Automated Infrastructure as Code Program Testing. IEEE Trans. Softw. Eng. 50 6 (June 2024) 1585\u20131599. doi:10.1109\/TSE.2024.3393070","DOI":"10.1109\/TSE.2024.3393070"},{"key":"e_1_3_3_2_76_2","doi-asserted-by":"publisher","DOI":"10.1145\/3643991.3644888"},{"key":"e_1_3_3_2_77_2","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380384"},{"key":"e_1_3_3_2_78_2","volume-title":"The State of Policy as Code Report: Insights as Organizations Scale Authorization Policies","author":"Inc. Styra,","year":"2023","unstructured":"Styra, Inc.2023. The State of Policy as Code Report: Insights as Organizations Scale Authorization Policies. https:\/\/www.styra.com\/resources\/reports\/policy-as-code\/"},{"key":"e_1_3_3_2_79_2","doi-asserted-by":"crossref","unstructured":"Angela Sweeney Kathryn\u00a0E Greenwood Sally Williams Til Wykes and Diana\u00a0S Rose. 2013. Hearing the voices of service user researchers in collaborative qualitative data analysis: the case for multiple coding. Health Expectations 16 4 (2013) e89\u2013e99.","DOI":"10.1111\/j.1369-7625.2012.00810.x"},{"key":"e_1_3_3_2_80_2","doi-asserted-by":"crossref","unstructured":"Ant\u00f3nio Trigo Jo\u00e3o Varaj\u00e3o and Leandro Sousa. 2022. DevOps adoption: Insights from a large European Telco. Cogent Engineering 9 1 (2022) 2083474.","DOI":"10.1080\/23311916.2022.2083474"},{"key":"e_1_3_3_2_81_2","doi-asserted-by":"publisher","DOI":"10.1109\/SANER.2018.8330206"},{"key":"e_1_3_3_2_82_2","doi-asserted-by":"crossref","unstructured":"Alexandre Verdet Mohammad Hamdaqa Leuson\u00a0Da Silva and Foutse Khomh. 2025. Assessing the adoption of security policies by developers in terraform across different cloud providers. Empirical Software Engineering 30 3 (2025) 74.","DOI":"10.1007\/s10664-024-10610-0"},{"key":"e_1_3_3_2_83_2","doi-asserted-by":"crossref","unstructured":"Denis Verdon. 2006. Security policies and the software developer. IEEE Security & Privacy 4 4 (2006) 42\u201349.","DOI":"10.1109\/MSP.2006.103"},{"key":"e_1_3_3_2_84_2","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180196"},{"key":"e_1_3_3_2_85_2","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3560416"},{"key":"e_1_3_3_2_86_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSA-C57050.2023.00073"},{"key":"e_1_3_3_2_87_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24100"},{"key":"e_1_3_3_2_88_2","doi-asserted-by":"crossref","unstructured":"Sebastian Zimmeck Peter Story Daniel Smullen Abhilasha Ravichander Ziqi Wang Joel Reidenberg N\u00a0Cameron Russell and Norman Sadeh. 2019. Maps: Scaling privacy compliance analysis to a million apps. Proceedings on Privacy Enhancing Technologies (2019).","DOI":"10.2478\/popets-2019-0037"}],"event":{"name":"MSR '26: 23rd International Conference on Mining Software Repositories","location":"Rio de Janeiro Brazil","acronym":"MSR '26","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 23rd International Conference on Mining Software Repositories"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3793302.3793355","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3793302.3793355","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T10:46:03Z","timestamp":1785494763000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3793302.3793355"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,13]]},"references-count":87,"alternative-id":["10.1145\/3793302.3793355","10.1145\/3793302"],"URL":"https:\/\/doi.org\/10.1145\/3793302.3793355","relation":{},"subject":[],"published":{"date-parts":[[2026,4,13]]},"assertion":[{"value":"2026-07-31","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}