The paper presents a longitudinal measurement study on the adoption of the pledge and unveil system calls in OpenBSD. These system calls are used to sandbox programs and libraries. Given a dataset covering 19 releases, many programs and libraries were modified to use the system calls already before their introductions in official releases. The adoption rates have also steadily grown; a linear trend provides a coarse but sensible heuristic. Although particularly programs residing in /usr/bin and /usr/sbin have been modified to use the system calls, the sizes of programs and libraries do not correlate well with the amounts of pledge and unveil system calls invoked. Regarding the pledges made, standard input and output operations have frequently been requested, although the full finegrained arsenal offered by pledge has generally been utilized in OpenBSD. The same observation is seen in that particularly read operations to given paths have frequently been unveiled. All in all, the measurement results indicate that the adoption of system call minimization and sandboxing techniques is not necessarily as troublesome as has often been discussed in the literature.
Building software is a crucial task in today's software projects. Build systems support developers by automating all essential tasks, such as compiling, testing, and assembling software projects. However, they must be maintained regularly to prevent build failures. Neglected maintenance of build configurations remains one of the main causes of build failures. In this paper, we explore an agent-based approach to automatically repair broken builds caused by dependency declaration problems. We leverage the capabilities of large language models (LLMs) to closely collaborate with provided tools. Our approach combines tools for retrieving further information about dependencies and build execution results with the LLMs. In a preliminary evaluation, we show that using the full error log our approach repairs up to 77% of the failing builds with an average of 1.32 repair steps. Using the parsed error log, our approach yields a repair rate up to 83% with 1.27 repair steps on average. In both cases, developers can also use smaller models run on their machine with only small reduction in performance.
Scoping reviews in software engineering require researchers to assess the relevance of thousands of papers, a task that is time consuming since accuracy is critical for the validity of the review. Therefore, many researchers rely on commercial LLMs or bibliography services APIs to automate large scale screening, but this raises significant concerns regarding data sovereignty, reproducibility, and long term cost. The main goal of this study is to benchmark open source large language models (LLMs) against GPT APIs to evaluate how reliable and accurate they are as local alternatives. This study assesses Mistral v2 (7B) and Llama 3.3(70B) alongside GPT 4.1 across three domains: verbalization methods (9,265 papers), program slicing (5,942 papers), and reactive programming (9,942 papers), to determine their applicability in software engineering scoping reviews. The models are employed in a screening pipeline that performs relevance screening based on paper titles only, to make large scale scoping review feasible. Their outputs are validated against expert reviewers using blind review (without seeing predictions) and informed review, focusing only on disagreements. Results show varying performance across domains and models. Mistral and Llama show different patterns than GPT, with more conservative screening. These findings suggest that properly engineered LLMs provide reproducible and cost effective performance, supporting their integration as reliable alternatives for large scale academic screening.
Energy efficiency is emerging as a key concern in sustainable software engineering, yet little is known about how modern frontend frameworks differ in their energy consumption. While performance comparisons of Angular and React are well documented, their environmental impact remains unexplored. This paper presents an empirical study comparing the energy consumption of equivalent applications implemented in Angular and React under controlled execution scenarios. Using the Firefox Power Profiler and automated execution scenarios, we measure energy consumption across multiple workloads. Results show that Angular consumes 21.66% less energy on average than React. Our findings highlight the importance of considering energy efficiency when selecting frontend technologies.
The integration of Large Language Models (LLMs) into Software Engineering offers efficiency but may also introduce significant risks. In Security Requirements Engineering (SRE), generic LLMs frequently exhibit omission errors-failing to identify necessary security constraints-and hallucinations. While Retrieval-Augmented Generation (RAG) mitigates factual errors, standard implementations rely on semantic similarity, creating a bottleneck that overlooks structurally necessary but semantically distinct security categories. To address this, we propose a specialized RAG framework designed as an automated Quality Assurance mechanism. Our approach integrates a curated OWASP Knowledge Base with a novel two-stage generation pipeline. Unlike single-shot RAG, our system incorporates a deterministic threshold-based feedback loop: it statically analyzes the initial output's coverage against the security taxonomy and triggers an adaptive compensatory generation to populate under-represented categories. We evaluated the framework on UniClass, a web application case study, across repeated executions. Empirical results demonstrate that the pipeline achieves a stable Mean Coverage of 72% across relevant security categories with a high Applicability of $\mathbf{8 1 \%}$, as verified by one project developer. By enforcing structural completeness before implementation, our approach serves as a critical QA guardrail for secure AI-driven development.
Service meshes like Istio provide built-in security mechanisms for microservices-based systems, but how they are configured and used in practice remains unclear. This study presents a large-scale empirical analysis of Istio security configurations across 7,429 GitHub repositories containing Istiorelated YAML files. We propose a method to systematically extract configurations across multiple API versions and analyze the adoption and combinations of key features, including mTLS, authentication, and authorization. We further map missing or incomplete configurations to potential security risks and quantify affected repositories. Our analysis shows that while Istio provides basic security by default, comprehensive configurations are only partially adopted. Although the combination of Strict mTLS, Peer Authentication, and HTTP Authorization is most common, many repositories disable mTLS, rely on deprecated Alpha APIs, or lack critical authorization mechanisms. As a result, over 6,000 repositories remain potentially vulnerable to attacks including highly starred projects. Overall, this study demonstrates that merely deploying a service mesh does not guarantee sufficient security, effective protection depends on comprehensive and correct configuration of Istio's security features.
This paper presents a software engineering framework for designing and implementing Distributed Ledger Technology (DLT)-based traceability systems in agri-food and agrotouristic ecosystems. The proposed approach integrates goaloriented requirements modeling (GOReM) with a permissioned blockchain infrastructure, specifically Hyperledger Fabric, to ensure transparent, verifiable, and sustainable supply chain processes. The methodology supports the conceptualization of stakeholder goals, business processes, and data flows through UML-driven modeling, enabling traceability from agricultural production to final consumption. A case study conducted in Calabria, a region in Southern Italy - developed in collaboration with the Regional Agency for Agricultural Development (ARSAC) - demonstrates the applicability of the framework across key sectors such as viticulture, olive oil production, and citrus farming. The resulting prototype enhances product certification, process transparency, and trust while aligning with the principles of Blockchain-Oriented Software Engineering (BOSE). Experimental evaluation confirms the system's scalability, low-latency performance, and suitability for real-world deployment, paving the way toward interoperable, model-driven DLT architectures for sustainable agri-food systems.
Mutation testing is an important technique for assessing the quality of test cases and software systems. It involves introducing changes into the code and identifying those changes. In the context of quantum computing, where programs are shown as quantum circuits composed of quantum gates, the traditional mutation testing techniques face unique challenges due to the inherent complexity of quantum algorithms and operations. We propose a novel strategy for higher-order mutation testing of quantum programs. Our main objective is to enhance the reliability of the quantum program. We propose a mutator to replace quantum gates in a quantum program. It identifies the gate combinations and their syntactic equivalence. We compare circuit state vectors to identify equivalent gate combinations and present the results for efficient mutation generation.
When developing machine learning (ML) solutions, it is crucial to build prototypes that demonstrate the solution's technical feasibility and potential value. These ML prototypes are typically Jupyter notebooks. However, manually reviewing ML prototypes is time-consuming and can lead to relevant qualities being overlooked from diverse stakeholders' perspectives. This paper introduces an innovative approach that uses LLMs to automate the ML prototype review process, thereby improving quality and stakeholder awareness. Through a systematic literature review, we identified key quality characteristics and information needs. The result is an ML prototype review catalog containing a quality model, a list of information needs, and stakeholder personas. We present Proto-Check, a JupyterLab extension that implements our LLM-based review process. Evaluation results demonstrate high usefulness and usability, as well as heightened developer awareness of stakeholder qualities and needs.
Large Language Models (LLMs) are increasingly embedded in software engineering workflows, yet the quality of the prompts used to guide these models remains largely unassessed. Poorly formulated prompts can lead to ambiguity, degraded output quality, or biased and unsafe model behavior. In this paper, we conduct a preliminary exploratory study aimed at establishing an initial foundation for systematic promptquality evaluation. First, we perform a rapid review of the literature on prompt engineering and analyze real-world prompts to derive a preliminary taxonomy of prompt smells—recurring patterns that signal potential quality issues. Each smell is operationalized through a quantitative metric capturing aspects such as grammatical correctness, readability, contextual adequacy, complexity-length, formality mismatch, and bias. We then apply these metrics to an existing corpus of developerwritten prompts and analyze their relationships using correlation analysis and multiple regression models. Our results show that syntactic metrics (e.g., grammar, readability) are strongly interrelated and largely explain the composite Prompt Quality Score, whereas higher-level smells such as contextual relevance, formality mismatch, and bias exhibit weak correlations and low explained variance. These findings suggest that many important prompt-quality issues operate independently of surface-level text properties and may require more semantically informed assessment techniques. Overall, this study offers an initial conceptual and empirical basis for the systematic evaluation of prompt quality, paving the way for more robust prompt engineering practices and automated quality-checking tools.
The increasing volume and variability of IoTgenerated data demand application infrastructures capable of dynamically scaling blockchain-backed data ingestion services while maintaining performance guarantees. This study presents a Kubernetes-based experimental framework for deploying and evaluating blockchain-backed IoT data ingestion pipelines under controlled, fluctuating workloads derived from real-world device patterns. The architecture integrates containerized blockchain services with horizontal pod autoscaling, enabling systematic investigation of capacity adaptation strategies in distributed ledger systems. Data streams originating from IoT sensors, including telemetry and energy monitoring measurements, generate realistic variable-intensity workloads for experimental evaluation. The framework supports quantitative analysis of throughput-latency trade-offs, resource utilization patterns, and system resilience under traffic variability. Two autoscaling policies are compared: a conservative configuration limiting horizontal expansion and an aggressive configuration permitting broader capacity scaling. Results show that expanded scaling capacity reduces mean response latency by 19% and tail latencies by 23-24%, at the cost of reduced throughput due to orchestration overhead. Both configurations maintain above 98% reliability under sustained highconcurrency conditions, demonstrating robust operation across the evaluated scaling range. Findings reveal fundamental tradeoffs between responsiveness and resource efficiency in autoscaled blockchain deployments. The framework provides a reproducible methodology for benchmarking the impact of infrastructure-level scaling decisions on end-to-end performance in IoT systems that persist data on a blockchain.
Recurrent neural networks such as Long ShortTerm Memory (LSTMs) and Transformer-based Large Language Models (LLMs) are increasingly deployed in applications that rely on sequential predictions, including time-series forecasting, code generation, dialogue systems, and decision support. Ensuring their reliability, robustness, and fairness remains challenging due to the oracle problem, non-determinism, distribution shift, and rapid model evolution. Metamorphic Testing (MT) has emerged as a promising strategy to alleviate the oracle problem by specifying expected relations between multiple executions rather than absolute outputs. However, while a growing effort applies MT to LSTMs and LLMs, the landscape is fragmented across domains, targeted properties, and tooling. This paper presents a literature-driven survey of testing techniques for LSTMs and LLMs with a particular focus on MT. We first characterise LSTMs and LLMs under a unified view of sequential prediction models and summarise traditional evaluation and non-MT testing approaches (e.g., adversarial, coverage-guided, and drift-aware testing). We then review and classify existing MT-based efforts along multiple dimensions, including model type (LSTM vs. LLM), application domain, transformation patterns, targeted properties (robustness, fairness, hallucinations, regression), and degree of automation. Finally, we identify gaps and outline open challenges for designing, selecting, and operationalising MT as a unifying testing strategy for sequential prediction models.
The challenge of achieving auditable, GDPR-compliant consent management while preserving true data subject privacy persists, as current blockchain-based solutions compromise anonymity through public ledgers. This paper addresses this by introducing a novel, privacy-by-design IT artefact built on the Ethereum platform that employs Zero-knowledge Succinct Non-Interactive ARgument of Knowledge (zk-SNARKs) to enable truly anonymous and irrefutable validation of data processing permissions. Implemented and evaluated through a Design Science Research (DSR) approach, the artefact demonstrated a high degree of functional and GDPR compliance, confirming its capacity to generate trustless, auditable on-chain proof of permission status. The proof of concept successfully implements core privacy-by-design principles through anonymity and encryption, with technical benchmarks indicating acceptable performance for the artefact's intended use despite the computational intensity of proof generation.
Software regression testing is a core practice in professional software development, yet students often struggle to explain its purpose, scope and role in automation beyond basic definitions or tool usage. This paper examines a characterdriven instructional intervention that presents regression-testing reasoning through a coherent narrative centered on a recurring protagonist. The paper describes the design rationale of the narrative, the associated instructional video and written task and a mixed-methods evaluation conducted in a master's-level Advanced Topics in Software Testing course. Data sources include pre- and post-test, open-ended responses, written task artifacts, and a post-activity feedback questionnaire. Students rated the narrative video highly in terms of clarity, engagement, and perceived learning value. Their written explanations of regression testing after a feature update reflected conceptually appropriate causal reasoning, linking change, risk, testing scope, automation, and consequences. Qualitative feedback further suggests that narrative elements supported reasoning organization, and helped reduce initial intimidation. Overall, the results indicate that character-first storytelling can function as a lightweight conceptual introduction in software testing education, particularly when narrative constraints are aligned with professional reasoning practices.
This study examines the combined effect of fine-tuning and semantic prompt enrichment on Large Language Model-based vulnerability detection in Solidity smart contracts. We fine-tune ChatGPT-4o through a two-phase process aligned with the DASP Top 10 taxonomy—first to internalize theoretical vulnerability knowledge, then to specialize on labeled Solidity functions. We further enhance the fine-tuned model with automatically generated and human-validated code summaries as semantic enrichments to its prompts. The resulting model achieves an average F1-score of 0.58, a 66% improvement over the baseline (0.35), with the largest gains in Access Control ($+146 \%$), Denial of Service ($+353 \%$), and Reentrancy ($+35 \%$) detection. These results show that domain-aligned fine-tuning and semantic prompt enrichment jointly improve the precision and recall of LLM-based smart-contract auditing, offering a practical path toward AI-assisted security analysis.
Context: Broken Access Control (BAC) is ranked by OWASP as the most critical web security risk. Open-source JavaScript projects, with their openness and diverse contributors, are particularly exposed. Objective: This study investigates the prevalence and patterns of BAC vulnerabilities in open-source JavaScript projects, addressing the lack of empirical evidence beyond enterprise systems. Method: A hybrid approach combined Semgrep static analysis with manual penetration testing. A curated set of 166 GitHub repositories was scanned using custom rules for Insecure Direct Object Reference (IDOR), unprotected routes, forced browsing, and token/session flaws; flagged cases were validated in Docker with Postman. Results: Static analysis flagged 33 repositories as potentially vulnerable, of which 5 were confirmed to contain exploitable BAC vulnerabilities through manual penetration testing. Confirmed issues included unauthenticated endpoints, parameter-based privilege escalation, and insecure token or Cross-Origin Resource Sharing (CORS) handling. Static analysis was useful, but showed high false positives and limited contextual accuracy. Conclusion: BAC vulnerabilities recur in open-source JavaScript projects. Static tools aid in detection but require manual validation for reliable assessment.
Large Language Models (LLMs) are an emerging technology that has changed many of our daily activities. In software engineering, we have seen current research on applying LLMs to elicit requirements, generate code, create tests, and perform code reviews, among others. Test amplification is a process to improve a test suite by adding more test cases that increase a specific measured target (e.g., code coverage). In this paper, we conducted an exploratory study to perform test amplification on Solidity contracts by using LLMs. First, we performed a pilot experiment on three different styled prompts to verify which would create better tests. Second, we conducted another pilot on five different LLMs (GPT 4o, GPT O3 Mini, Gemini 2.0 Flash, Claude 3.5, and Claude 3.7 Sonnet) to verify their code coverage outcomes when creating more test cases. Finally, in our main experiment, we used the best-performing prompt and three LLMs from our pilot experiments to amplify the tests in 113 Solidity contract files. Our results show that Claude 3.7 achieved the highest code-coverage metrics, but also generated many more test cases than the other LLMs.
Microservice-based systems introduce significant complexity due to the distributed interactions among many independently deployed services. As a result, analyzing monitoring data and distributed traces has become an important foundation for techniques in anomaly detection, fault localization, and reliability assessment. However, research in this area is often limited by the lack of realistic, publicly available datasets that include both fault-free and faulty executions. In this paper, we present a comprehensive dataset collected from TrainTicket under simulated load, including distributed traces, metrics, and application logs. To support research on fault analysis, data were gathered not only from a clean reference version of TrainTicket but also from nine versions containing seeded faults, enabling controlled comparisons between correct and faulty executions. We describe the dataset generation process, detail the organization and content of the data, and provide a set of baseline metrics that characterize its structure and variability. The dataset aims to support researchers in developing and evaluating methods for microservice trace analysis, anomaly detection, and fault localization.
Many layer two networks on Ethereum claim to implement equivalent functionality as Ethereum itself. Often, this is achieved by taking Ethereum client code and re-using it to build layer two blocks. In this work, we look at the re-use and modification of the Go Ethereum (geth) client by layer two networks. We compare the similarity of these codebases to the geth codebase in order to understand what kinds of changes are made and how these codebases evolve. This is important to determine how prevalent vulnerabilities might be, determine how updates are propagated, and establish dependencies that exist within the Ethereum layer two ecosystem. We find that the majority of layer two networks are in fact re-using geth code, but it is not always clear what the specific codebases are being used to operate these networks. This contrasts with the open-source ethos of the broader ecosystem and reinforces that most layer two networks are operated not only in a centralized manner but also in an opaque one. Moreover, this demonstrates that there may be significant challenges in determining whether security updates have been applied across these networks.
As modern software systems grow in complexity and scale, their energy consumption becomes a critical concern, highlighting the need for automated mechanisms capable of monitoring, managing, and optimizing energy usage while balancing potential trade-offs with other software quality attributes. To address this challenge, this work proposes an automated agentoriented orchestration workflow that integrates a multi-agent, LLM-driven refactoring process into the software development lifecycle. In the proposed approach, one agent recommends code optimizations aimed at improving energy efficiency, while a second agent verifies the correctness of the proposed changes. The workflow is integrated into existing CI pipelines, which define and execute performance tests-tests specifically designed to exercise the software under realistic workloads-to measure applicationlevel energy consumption. This approach allows developers to identify inefficient algorithms, redundant operations, or resourceintensive functions. The execution results of the automatically refactored code are then compared with those of the original version to assess improvements in energy efficiency and other relevant software quality attributes. The approach is evaluated through controlled executions to analyze both its effectiveness and the impact of AI-driven code optimizations. The results indicate that the proposed workflow effectively supports energyaware software development by automating the coordination of energy measurements and agent-based code improvements, while requiring minimal developer intervention.
