Software Security

Follow this topic Ask about this topic

Software security examines how flaws arise in programs and systems, how attackers can exploit them, and how developers can prevent or fix them. Common approaches include static analysis and taint tracking, dynamic testing and fuzzing, dependency and vulnerability analysis, threat modeling, and formal verification. Large language models and coding agents are increasingly applied to vulnerability detection, exploit reproduction, and patch generation, with evaluation using CWE- and CVE-based tasks, fuzzing targets, and smart-contract tests. A central challenge is that functional tests and static checks do not establish security: tools must balance missed flaws against false alarms, and generated fixes need realistic validation before deployment.

Latest papers

95 papers13 papers in the last four weeks, up 18% on the four weeks before. 0.1% of all new papers.

From Leaderboard to Deployment: Code Quality Challenges in AV Perception Repositories
Mar 2, 2026Mateus Karvat, Bram Adams, Sidney GivigiSoftware Security Autonomous Driving Perception
School of Computing, Queen’s University. Kingston, ON, Canada.
Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents
Feb 28, 2026Linxi Jiang, Zhijie Liu, Haotian Luo +1AI Agent Security Web Agents
The Ohio State University
SecureCode: A Production-Grade Multi-Turn Dataset for Training Security-Aware Code Generation Models
Dec 20, 2025Scott ThorntonSoftware Security LLM Security
Is Vibe Coding Safe? Benchmarking Vulnerability of Agent-Generated Code in Real-World Tasks
Dec 2, 2025Songwen Zhao, Danqing Wang, Kexun Zhang +3AI Coding Agents Software Security
Carnegie Mellon University, Language Technologies Institute · Columbia University · Johns Hopkins University +1
Propheticus: Machine Learning Framework for the Development of Predictive Models for Reliable and Secure Software
Sep 6, 2018João R. Campos, Marco Vieira, Ernesto CostaSoftware Security
DEI/CISUC, University of Coimbra, Portugal

Mar 2, 2026J/K move · Enter open · S save

From Leaderboard to Deployment: Code Quality Challenges in AV Perception Repositories

Mateus Karvat, Bram Adams, Sidney Givigi

School of Computing, Queen’s University. Kingston, ON, Canada.

Software Security Autonomous Driving Perception

Open paper AskPDF arXiv

Autonomous vehicle (AV) perception models are typically evaluated solely on benchmark performance metrics, with limited attention to code quality, production readiness and long-term maintainability. This creates a significant gap between research excellence and real-world deployment in safety-critical systems subject to international safety standards. To address this gap, we present the first large-scale empirical study of software quality in AV perception repositories, systematically analyzing 178 unique models from the KITTI and NuScenes 3D Object Detection leaderboards. Using static analysis tools (Pylint, Bandit, and Radon), we evaluated code errors, security vulnerabilities, maintainability, and development practices. Our findings revealed that only 7.3% of the studied repositories meet basic production-readiness criteria, defined as having zero critical errors and no high-severity security vulnerabilities. Security issues are highly concentrated, with the top five issues responsible for almost 80% of occurrences, which prompted us to develop a set of actionable guidelines to prevent them. Additionally, the adoption of Continuous Integration/Continuous Deployment pipelines was correlated with better code maintainability. Our findings highlight that leaderboard performance does not reflect production readiness and that targeted interventions could substantially improve the quality and safety of AV perception code.

Latest papers

From Leaderboard to Deployment: Code Quality Challenges in AV Perception Repositories

Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents

SecureCode: A Production-Grade Multi-Turn Dataset for Training Security-Aware Code Generation Models

Is Vibe Coding Safe? Benchmarking Vulnerability of Agent-Generated Code in Real-World Tasks

Propheticus: Machine Learning Framework for the Development of Predictive Models for Reliable and Secure Software