This article presents an experience report on the development of Sidagro Web, a governmental system developed through a partnership between the Federal University of Lavras (UFLA) and the Agricultural Institute of Minas Gerais (IMA), with a primary focus on software quality assurance. The report details key architectural and technical decisions that guided the project throughout its lifecycle, providing the rationale for each choice and emphasizing their contributions to enhancing system quality. The discussion is organized into five main categories: (i) high-level architectural choices, including layered separation and foundational technologies; (ii) backend-specific decisions, such as exception handling, object mapping, auditing mechanisms, and code conventions; (iii) frontend considerations, including form validation and dynamic data handling; (iv) infrastructure-related strategies, covering environment setup, CI/CD pipelines, and DevOps tooling; and (v) documentation and version control practices, which are applied transversally across all project dimensions. We demonstrate that the systematic adoption of these practices significantly improved the system’s robustness, maintainability, and long-term sustainability, offering valuable insights for similar large-scale software projects with stringent quality requirements.
Efficiently managing user stories during the testing process is crucial in large, distributed test teams to ensure timely and high-quality project completion. Manual control of tasks, from various software testing activities to extracting specific quality metrics and maintaining test processes, is time-consuming and error-prone. This paper proposes an approach to automate story creation for the Jira tool to address these challenges. The proposal approach aims to optimize the time spent on story creation, promote efficiency, and increase the success rate of story creation from 73.43% to 99.66% in the story management process. The script developed establishes a secure connection with Jira, imports data from spreadsheets, populates these into Jira, and creates or updates test tasks. Additionally, JavaScript (JS) code automates data transfer from task creation to planning. This automation significantly reduces manual effort and minimizes human errors, due to the improvement in the success rate to 98.14%, and increases the productivity of the software testing team by 15.19%.
Teaching aeronautical software quality standards, such as RTCA DO-178C and RTCA DO-200B, presents significant challenges, mainly when delivered to students who do not work directly in this domain. This paper explores the complex characteristics of conveying these specialized standards to a diverse audience. We identify the primary challenges in the teaching-learning process through a detailed analysis of the difficulties faced. These challenges include the need to contextualize aeronautical quality standards with practical examples, the abstract nature of the content, and the necessity for interactive methods and teaching resources to facilitate comprehension. This study provides insights for educators and educational institutions to improve their approaches to teaching aeronautical software quality standards.
Test smells signal design flaws in tests, harming maintainability and reliability. While automated test smells are well-studied, natural language test smells remain underexplored. Prior work identified 13 such smells but lacked systematic removal strategies and automated tools.We bridge this gap by presenting a catalog of transformations for seven key natural language test smells and a NLP-based tool for automated detection and correction. We evaluated our approach through a survey of 15 professionals and empirical analysis of Ubuntu OS test cases. Results show high professional acceptance (91.43%) and strong tool precision (83.70% F-Measure). Our work is the first to systematically address natural language test smell removal.
Teaching non-functional testing and software quality attributes presents persistent challenges due to the abstract and theoretical nature of the content. To address this, we developed Critical Failure, a card game designed to support learning through playful competition and active engagement. Inspired by poker mechanics and adapted for educational use, the game encourages players to evaluate and critique each other’s hands as software systems, simulating the evaluation of quality attributes such as performance, usability, and security. The game was created as part of a Software Testing course to offer a more interactive alternative to traditional lectures. The game was played by a group of 17 students who provided highly positive feedback on its clarity, engagement, and educational value. Suggestions for improvement were incorporated into the final version, refining both gameplay balance and alignment with course content. The activity demonstrated strong potential as a didactic tool, helping students not only recognize various non-functional requirements but also understand how they interact and impact the testing process. This article presents the design of the game and reports on its initial classroom use as an exploratory activity, intended to gather impressions, refine mechanics, and assess its potential as a complementary tool for teaching non-functional testing concepts.
Context: Developer productivity is a critical factor of software project success and, by extension, a key driver of organizational performance and software quality in software engineering. In the era of Generative Artificial Intelligence (GenAI), understanding the developers’ perception of productivity becomes paramount for a software organization seeking to adopt GenAI tools. Objective: This paper aims to examine developers’ perception of productivity, focusing on its measurement and the expected impact of adopting GenAI. Method: We conducted two semi-structured focus groups with software developers from a large science and technology institute. We also administered a confirmatory questionnaire to support the verification of our findings. The collected data were analyzed using content analysis. Results:We identified five key productivity factors: quality, expectations, deadlines, progress, and efficiency, including distinct measurement systems for coding, code review, and documentation activities. Participants consistently emphasized the potential of GenAI to streamline and enhance a range of routine development tasks, albeit with certain limitations regarding their use. Conclusion: Our findings indicate that productivity constitutes a complex multidimensional construct influenced by interrelated factors. Moreover, GenAI emerge as a transformative technology whose impacts on productivity require deeper investigation in future studies, particularly regarding balancing efficiency gains with the preservation of technical abilities.
Psychological safety and individual emotions have proven essential for the effective functioning of agile teams, directly impacting collaboration, collective performance and ultimately, software quality. This paper presents AgileMood, a tool designed to diagnose and enhance psychological safety and emotional awareness in agile teams through the collection of periodic anonymous feedback, the calculation of specific metrics, and the generation of dynamic visualizations. The solution not only measures the overall perceived level of safety and emotions but also detects internal variations among team members, enabling data-driven interventions. Agile-Mood distinguishes itself from existing approaches by incorporating well-established theoretical foundations, preserving anonymity, and offering practical support for decision-making by team leaders. The empirical evaluation of the tool, conducted through a case study involving 41 students (7 teams of 5 to 8 team members), utilized the System Usability Scale (SUS) and the Technology Acceptance Model (TAM), demonstrating promising usability and high perceived usefulness. Available as open-source software, the tool facilitates replicability and further development by the community. As a contribution, this work proposes a practice-oriented artifact with the potential to transform psychological safety and emotions into a measurable and manageable element within agile software development teams, thereby fostering improved software quality. Future studies should empirically evaluate its application in real organizational contexts.
Studies indicate that approximately 15% to 20% of the global population may be considered neurodivergent, including individuals with Tourette Syndrome, Dyslexia, Autism Spectrum Disorder (ASD), and Attention Deficit Hyperactivity Disorder (ADHD). It is also estimated that around 7 million children between the ages of 3 and 17 (11.4%) have been diagnosed with ADHD. Despite recent advances in promoting inclusion within Software Engineering, there is still a lack of structured strategies to adapt the teaching and practice of Software Quality to the needs of neurodivergent individuals. This study proposes a mapping between one of the behavioral profiles of ADHD, as defined in the Diagnostic and Statistical Manual of Mental Disorders (DSM-5), and the main activities in the Software Quality domain, as outlined in the SWEBOK V4. A qualitative approach was adopted, based on a documentary review, in which the technical tasks described in the Software Quality area were cross-analyzed with the behavioral characteristics of ADHD. This process enabled the identification of potential cognitive barriers. As a result, a conceptual table is presented, relating technical activities, associated difficulties, and inclusive good practice guidelines, applicable both in educational and professional contexts. The proposed model contributes to cognitive inclusion in the field of Software Quality, supporting the development of strategies that enhance the engagement, learning, and performance of individuals with ADHD. Finally, it is suggested that future studies conduct empirical validations to deepen and apply the findings in real-world settings.
Background: The software industry has undergone rapid changes driven by agile methodologies, continuous delivery pipelines, and increased automation. As system complexity and quality demands grow, the role of Quality Analysts (QAs) has become increasingly critical. This shift is particularly relevant in the current context, characterized by the rapid evolution of QA practices, technological advancements, and the increasing adoption of AI-based tools that provide assisted support throughout the software development process. Objectives: This study aims to identify the key technical and behavioral competencies that characterize high-performing QAs, from the perspective of experienced practitioners in the Brazilian software industry. Method:We carried out two large-scale surveys involving Brazilian companies, conducted in 2021 and 2025, with a total of 169 participants. Results: The findings reveal a strong and growing demand for soft skills, especially communication and critical thinking, alongside solid technical foundations. Respondents emphasized the evolving and multidisciplinary nature of the QA role in modern software development contexts. Conclusions: This research offers a comprehensive and recent overview of industry expectations regarding QA analyst competencies in Brazil. The results provide actionable insights for those seeking to advance in the QA field, educators aiming to align curricula with market demands, and organizations aiming to strengthen their software quality assurance capabilities.
Process modeling is a key component for the success of an information system. Ensuring the quality of these models is essential for developing effective systems, including accessibility, auditability, understandability, informativeness, and usability. This article presents the design and evaluation of the Transparency-oriented Process Checklist (TPC), a structured inspection instrument for BPMN models emphasizing transparency-related quality characteristics. The TPC was developed by analyzing and integrating items from two existing checklists (CMP and BPCheck), refining them based on transparency dimensions, and structuring it with 51 verification items. A comparative evaluation was conducted to assess the applicability and effectiveness of the TPC. The evaluation team was divided into two groups. One group used the TPC, while the other applied BPCheck to inspect a real-world BPMN model. The results demonstrated that the TPC facilitated the identification of more quality problems (21 vs. 17), achieved greater agreement with the predefined “Oracle” answers (68.63% vs. 36.36%), and received more favorable assessments regarding understandability and support for identifying auditability issues. These findings underscore the TPC’s potential as a valuable instrument for supporting the inspection for the enhancement of BPMN process models.
Graphical User Interface (GUI) testing plays a fundamental role in ensuring the reliability and quality of web applications by validating functionalities and exposing faults. Automated GUI testing tools are crucial for scaling this process, particularly in identifying visible failures such as crashes, error messages, and unexpected behaviors. However, their application in real-world, large-scale systems poses persistent challenges, including: (i) the automatic and non-redundant discovery of actionable elements, (ii) reliable synchronization with dynamic content, and (iii) efficient and thorough exploration of complex GUIs. This work addresses these challenges through the design and evaluation of three novel techniques: Unique Actionable Elements Search (UAES) for accurate element detection, the NetworkWait mechanism for robust synchronization, and the Iterative Deepening URL-Based Search (IDUBS) algorithm to guide scalable and effective exploration. These techniques are integrated into Cytestion, a new automated GUI testing tool for web applications. Cytestion follows a scriptless and progressive testing approach, starting from a seed test and incrementally exploring the interface by leveraging browser console errors, HTTP status codes, and GUI failure indicators as oracles. We evaluated our solution in a series of empirical studies involving four open-source and twenty industrial web applications. Results show that Cytestion significantly outperforms a state-of-the-art GUI testing tool in both fault detection effectiveness and runtime efficiency. In addition to its academic contributions, Cytestion has been adopted as part of the quality gate mechanism of an industry partner, demonstrating its practical applicability and impact.
Requirements Engineering for AI-based systems (RE4AI) demands approaches that integrate technical, social, and human-centered dimensions. For instance, when eliciting requirements for AI systems, one must account for data biases and imbalances that may lead to decisions reinforcing stereotypes and excluding certain user profiles without making such effects visible. Despite the topic’s relevance, teaching RE4AI remains nascent and lacks suitable pedagogical methods. To address this gap, this study examines the use of the RE4HCAI framework as a pedagogical aid for teaching requirements elicitation in AI systems, attending to technical, human, and social dimensions. We conducted a classroom activity with 86 students, applying the framework and collecting perceptions of its usefulness. Among participants, 66% reported that using the RE4HCAI framework fostered reflection on themes such as responsibility, bias, and explainability. Despite its formative potential, students noted challenges related to linguistic complexity, the need for prior knowledge, and the clarity of instructions. This work offers preliminary empirical indications and provides structured materials that can support instructors in teaching RE4AI.
Context: Large language models (LLMs) like ChatGPT have gained attention in automated software testing. This study evaluates ChatGPT-3.5-turbo’s ability to generate test sets for Python programs, comparing it with Pynguin and pre-existing test sets. Problem: Automated testing remains challenging for dynamically typed languages like Python, requiring adaptable tools for diverse code structures. Solution: We assessed ChatGPT-3.5-turbo’s test generation using different prompt configurations and temperature settings. Method: Using 40 Python programs, we generated Pytestcompliant tests via the OpenAI API, varying temperature settings (0.0 to 1.0). Tests were validated using Pytest, with coverage and mutation scores measured via Coverage, MutPy, and Cosmic-Ray. Pynguin-generated and pre-existing test sets served as baselines. Summary of Results: ChatGPT-3.5-turbo successfully generated valid tests for simpler programs, but averaged below 28% overall, with a low cost. Higher temperatures (0.5–1.0) improved results, but combining test cases from all temperatures introduces diversity in the LLM-generated test sets, making it possible to overcome both Pynguin and pre-existing test sets in terms of decision coverage and mutation score.
Context: Teaching software quality concepts can be challenging due to their abstract nature and limited engagement with traditional instructional methods. To address this, educational games have emerged as an effective strategy for improving motivation and learning outcomes, particularly in Information Technology programs. Aims: This paper reports on the development and evaluation of the educational game LEAGUE OF QUALITY: ISO/IEC 25000, which aims to teach software product quality concepts based on ISO/IEC 25000. The goal is to introduce diversity into the course and enhance students’ skills, engagement, and knowledge. Method: The development of the game followed four phases: pre-production, pilot testing, production, and finalization. The game was applied in classroom settings with IT students at a Brazilian university. Data was collected from both students and professors regarding their perceptions of the game’s effectiveness and usability. Results: Most students reported that the concepts presented in the game were applicable to real-world professional scenarios. They found the dynamics of the game clear, accessible, and engaging, contributing positively to their understanding. The game provided a better learning experience, especially for students with little prior knowledge. Professors also observed increased motivation, participation, and improved learning outcomes. Conclusions: LEAGUE OF QUALITY proved to be an effective and engaging educational tool for teaching software product quality. It enhanced student motivation, especially among those with limited prior knowledge, and promoted better understanding and retention of key concepts. Both students and professors reported increased engagement, with students highlighting the game’s relevance to real-world practice and its positive impact on the learning experience.
Context: The increasing complexity of digital public services has heightened the need for robust governance mechanisms in privacy and information security, particularly in light of Brazil’s General Data Protection Law (LGPD). However, public institutions often lack clearly defined roles, responsibilities, and competencies for professionals managing sensitive data and system security. Objective: This study aims to develop a comprehensive competency framework that maps the responsibilities and required knowledge, skills, and abilities (KSAs) for key privacy and information security roles in the Brazilian federal public administration. Method: We employed a design science approach, grounded in national regulations (LGPD, PPSI, IN GSI/PR nº 3/2021) and international standards (e.g., ISO/IEC 27701), to analyze legal and normative documents. The process included the identification of 24 institutional roles (8 in privacy, 16 in information security), the modeling of KSAs across three proficiency levels, and the use of the Analytic Hierarchy Process (AHP) to prioritize competencies. Results: The resulting framework provides structured competency profiles for each role, supporting training journey design, maturity assessment, and decision-making for role allocation. An interactive online platform makes the full model publicly accessible, offering practical tools for public sector adoption. Key findings highlight overlapping areas between privacy and security domains, reinforcing the need for coordinated institutional efforts. Conclusion: By clarifying role expectations and aligning them with legal and technical requirements, the framework supports public organizations in improving their institutional maturity in privacy and security governance. It also contributes to the quality, reliability, and trustworthiness of digital public services through strategic capacity-building.
This study introduces a hybrid methodology combining Natural Language Processing (NLP) and Quality Function Deployment (QFD) to enhance the quality and responsiveness of institutional academic systems. The approach systematically transforms unstructured user complaints into functional software requirements, thereby improving documentation and maintenance in legacy systems. By leveraging NLP to extract and prioritize user needs based on dissatisfaction severity and frequency, and translating these into technical requirements via QFD, the method creates a scalable, usercentered, and traceable requirements engineering process, ideal for legacy systems with limited documentation. Analyzing 4,357 service tickets, our results identify critical improvement areas, including authentication, enrollment, and bureaucratic workflows. Although steps like technical mapping and modeling remain manual, the methodology boosts prioritization, transparency, and alignment with essential software quality attributes. While applied to this specific context, the framework shows potential for transferability to other institutional or commercial sectors. These findings demonstrate the value of integrating AI with software engineering principles to modernize complex institutional platforms and increase user satisfaction.
This paper investigates the impacts of secure design methodologies on the structural quality and presence of vulnerabilities in systems developed in Java. We analyzed 333 popular GitHub repositories, classified according to four security approaches: Security by Design, Defense in Depth, Runtime Security and Zero Trust Architecture. Using static analysis techniques, we evaluated vulnerabilities based on the CWE taxonomy, in addition to code quality metrics such as coupling (CBO), cohesion (LCOM) and cyclomatic complexity. The results indicate that the adoption of secure design practices, although relevant for risk mitigation, can negatively impact the modularity of the system. In particular, approaches such as Security by Design presented higher levels of coupling and lower cohesion. We also observed that the combination of multiple security practices did not necessarily result in a lower number of vulnerabilities, suggesting an increase in complexity without proportional benefit. These findings highlight the importance of balanced architectural decisions that consider the commitments between security and internal software quality.
The quality of system requirements is essential to ensure that the software meets user needs. In the context of software engineering, specifying requirements through user stories and prototypes has become a widely adopted practice in the industry, as it facilitates effective communication among requirements, development, and testing teams. However, for these practices to be effective, information essential to developing functionality must be clearly specified and organized. To support this verification process and ensure the completeness of artifacts, this work proposes VUSP (Checklist for the Assessment and Verification of User Stories and Prototypes), focused on the verification of requirements artifacts. The feasibility of VUSP was evaluated in a study involving 38 participants from a Software Engineering course at the Federal University of Amazonas, who used the checklist to verify user stories and prototypes. Participants provided feedback on the tool’s usability and effectiveness using the TAM (Technology Acceptance Model), addressing aspects such as perceived ease of use, work relevance, and behavioral intention. The results indicate that VUSP helped identify improvements in documentation and the centralization of essential information for development.
Context: The digitalization of public services in Brazil has improved access and efficiency, but has also raised concerns about transparency, privacy, and data protection. Despite the regulatory framework established by the Brazilian General Data Protection Law (LGPD), many services still lack clear communication and support for citizens regarding how their data is handled. Objective: This study aims to evaluate the trustworthiness of digital public services in Brazil, from the perspective of an ordinary citizen, by analyzing the alignment between declared privacy practices and actual data handling behaviors, as well as the accessibility of support provided to citizens in exercising their data protection rights. Method: We developed and applied a structured evaluation checklist based on three dimensions: (i) Declared Information Quality (QID), (ii) Factual Precision (PF), and (iii) Accessibility Support (AS). Five widely used federal services were selected and analyzed through manual inspection of public documentation, service behavior, and availability of support channels. Each item was scored based on predefined criteria, and qualitative observations were recorded to complement the analysis. Results: The overall average score across all services was 44.76%, with the best performance in factual precision (77.14%) and the worst in privacy support (20.00%). Only one service—“Conta Gov”—achieved a score above 50%. Transparency deficits were common, especially in the disclosure of sensitive data handling and the availability of dedicated support channels or Data Protection Officers (DPOs). Conclusion: The study reveals that while several services functionally comply with privacy expectations, most fail to communicate this effectively to users. The absence of accessible and explicit privacy declarations, combined with limited support mechanisms, undermines citizens’ ability to exercise their rights and reduces trust in digital government services. Our findings highlight the need for standardized privacy documentation and specialized support channels, reinforcing the importance of transparency as a critical component of software quality in the public sector.
The Modern Code Review (MCR) process is iterative and asynchronous, enabling the early identification of issues during development. One of the main challenges in this context is the presence of code clones, fragments of code copied with small modifications that hinder maintainability. In this study, we analyzed 80k revisions from the CROP dataset using the Siamese detector, identifying 27,656 relevant clones across six systems. A manual validation indicated a predominance of Type-I (46.7%) and Type-III (45.3%) clones. We also identified 224 reviews in which clones appeared in a single revision (Single), 1,258 reviews in which clones appeared across multiple revisions (Recurring), and 236 reviews at the intersection of both categories. To deepen the analysis, we introduced two metrics, Duration and Distance, to assess how clones are introduced or removed during the review. This paper presents an expanded abstract of the study “An Exploratory Study on the lifecycle of Code Clones During Code Review”, published at SBES 2025.
