Security bug report prediction (SBRP) is important for software reliability because missed security issues can delay vulnerability fixes and cause operational failures or financial losses. In practice, separating security bug reports (SBRs) from non-security reports is difficult because SBRs are rare and bug reports contain mixed text, such as natural language, logs, code snippets, and configuration details. Therefore, methods based on shallow text features or artificial oversampling often fail to capture security-relevant context and may miss true security reports.We present LLMSec, an LLM-based approach for automated security bug report identification that combines the relevance-guided report selection with contextual text representation. LLMSec first ranks non-security reports using the BM25F-based field-aware similarity scoring and retains low-overlap non-security reports, reducing class imbalance while preserving real negative examples without synthetic data generation. The resulting reports are encoded as dense features using pretrained LLM-based encoders that capture contextual information from bug-report summaries and descriptions. These features are then used with the standard machine learning classifiers. Experiments on five public security bug report datasets from Ambari, Camel, Derby, Wicket, and Chromium show that LLMSec improves security-report detection over existing methods while maintaining competitive false-alarm rates. These results suggest that combining BM25F-guided report filtering with LLM-derived contextual representations provides a reliable basis for identifying security-related reports across heterogeneous software projects.
As generative artificial intelligence (GenAI) increasingly permeates software development, Agile organizations face growing pressure to achieve continuous lifecycle compliance amid rapidly evolving regulatory demands. Classical Structuration Theory and its derivatives account for technology as either an instantiation of social structure or a medium for human agency; neither pole adequately captures GenAI’s quasi-autonomous capacity to reshape organizational practices and give rise to new regulatory obligations. This study addresses this gap by developing Triadic Structuration Theory. Following an incremental design science research (DSR) paradigm, we develop this abstract design artifact through cycle-level intermediate artifacts, with cross-cycle knowledge accumulation. Cycle 1 derives a problem backlog of GenAI-induced tensions in Agile practice. Cycle 2 conceptualizes RegOps, showing how Agile agency adapts under regulatory pressure. Cycle 3 designs an EU AI Act-aligned model card template, showing how regulatory structure becomes embedded in generative technology. Cycle 4 explores GenAI-enabled solutions to ISO-related compliance barriers in an Agile company. Together, the evidence and knowledge accumulated within and across the cycles position generative technology as a third construct rather than a medium between agency and structure. Regulatory structure is embedded directly into it; it reshapes Agile agency through quasi-autonomous action, and its use to meet existing obligations may recursively generate new ones. The study extends Structuration Theory as a middle-range theory to Agile and GenAI contexts, and demonstrates how nested DSR with intermediate artifacts can support theory development. For practitioners, it offers guidance on leveraging GenAI for compliance, cautioning that it is a structural intervention rather than a one-off fix.
Large language models (LLMs) are increasingly used in software engineering, yet empirical understanding of sustained LLM-assisted architecting remains limited. Existing work largely treats LLMs as generators of isolated artifacts rather than participants in continuous architecting processes. This paper presents an empirical study of vibe architecting, a minimally human-in-the-loop approach in which architectural structure, constraints, and behaviors emerge through continuous prompting with an LLM under minimal human guidance. Two systems, NutriCompass and MenuCal, are developed using ChatGPT and Gemini, respectively, under the same prompt sequence with minor progressive variations. The architectural artifacts produced through vibe architecting are evaluated using an artifact evaluation rubric based on correctness, completeness, and consistency. NutriCompass achieves slightly higher overall validity than MenuCal (0.86 vs. 0.83), primarily due to stronger completeness (0.91 vs. 0.78), while both systems exhibit comparable correctness and high consistency. The average validity across both cases is 0.84, indicating generally high artifact validity under the defined artifact evaluation rubric. Vibe architecting exhibits stronger results during early and intermediate architectural activities focusing on structural exploration with a clear and detailed system description. However, the study also confirms that although vibe architecting may reduce human effort, human involvement remains necessary to evaluate outputs and refine artifacts as the prompt sequence progresses, reinforcing the role of LLMs as architectural articulation aids rather than autonomous decision-makers. Broader industrial evaluation and prompt sensitivity analysis are left as future work directions.
Cross-lingual code clone detection aims to identify functionally equivalent code fragments written in different programming languages. Existing detectors often achieve high F1 scores on standard benchmarks, but these scores may be inflated by code or problem overlap and shallow lexical or structural cues. It is therefore unclear whether the detectors compare the semantics of two code fragments or exploit regularities in benchmark construction. To investigate this issue, we conduct a behavioral audit of six representative clone detectors on Java-to-X pairs from Project CodeNet. The audit combines protocols with increasingly strong isolation controls, shortcut controls, partner shuffling, and meaning-preserving and behavior-changing edits.Our results show that measured performance depends strongly on the evaluation protocol. GraphCodeBERT and UniXcoder fall from F1 scores of 0.9848 and 0.9916 under pair-random evaluation to 0.6588 and 0.6970 under problem-disjoint evaluation. Shallow Control achieves an F1 of 0.6889, showing that even problem-disjoint splits retain exploitable non-semantic cues. Partner shuffling further reveals that detectors differ in their reliance on the original cross-lingual pairing. Semantic counterfactuals show that GraphCodeBERT is stable under meaning-preserving edits but insensitive to behavioral changes, while DeepSeek-v4-flash exhibits the reverse pattern. No evaluated detector achieved both high preservation stability and high breaking rejection on this counterfactual set. Thus, neither high F1 nor clean splitting alone demonstrates cross-lingual semantic understanding. Evaluations should also test shortcut reliance, use of both code snippets, and responses to semantics-preserving and semantics-breaking edits.
Modern code review is a crucial practice to improve software quality nowadays. The interactive and iterative nature of this process leads to a huge workload and time cost, especially for multi-round reviews. Recent studies have explored automating parts of the review process using deep learning techniques. However, most approaches treat code review as a single-round process, overlooking valuable contextual information of multi-round interaction, which actually accounts for 29% to 63% in industry. In this work, we explore a multi-round auto-code-review setting, aiming to predict the quality of the given code change based on its review history. We introduce RCQE (Reviewed Code Quality Estimation), a model designed for automatic code change quality estimation in multi-round reviews. RCQE leverages context-aware prompt-tuning, which incorporates historical review information (i.e., code diffs and review comments) as context and reformulates the task into a cloze-style format by adopting the prompt-tuning paradigm, jointly modeling the programming and natural language to predict the quality of the given commit. To train and evaluate RCQE, we construct a dataset of 20,920 instances from 22 open-source Java projects, which are all in multi-round mode. The results indicate that RCQE achieves an overall accuracy of 80.8%, outperforming the state-of-the-art baseline by 34.6%. Ablation studies further confirm that incorporating multi-round contextual features contributes to overall performance. Additionally, we have built an RCQE-based practical tool and deployed it in open-source communities to assist code reviewers in identifying potentially problematic commits, and the assessment demonstrates its effectiveness and practical applicability in real-world code review scenarios.
