Developer experience · Empirical study of disclosure practices and practitioner preferences

An Empirical Study on Vulnerability Disclosure Management of Open Source Software

ACM conference proceedings · 2025

Shuhan Liu, Jiayuan Zhou, Xing Hu, Filipe Roseiro Cogo, Xin Xia, Xiaohu Yang

Summary

Shows disclosure management practices and preferences vary, making governance and communication central to OSS security.

For your marketing

Possible founder application

Publish a clear vulnerability-reporting policy, triage ownership, and response expectations.

Reported result

What the study found

Shows disclosure management practices and preferences vary, making governance and communication central to OSS security.

Research question

What the authors investigated

How does the study’s stated design explain its reported outcome in this setting?

Design

Empirical study of disclosure practices and practitioner preferences

Sample and setting

OSS projects/practitioners; exact sample unavailable on abstract page.

Scope and transfer

Limitations to keep in view

Abstract/page evidence limits detailed sample and external-validity assessment.

Research sources

abstract_only

Study strength

3.5/5 Abstract-level evidence is useful for framing questions; verify full methods before transfer.

How this was assessed

The 1–5 evidence-check score is a practical reading aid, not a formal peer review or a probability that a conclusion is true. It combines design strength (2 points), sample reporting (1), comparison/control clarity (1), and how much of the paper could be checked (1). Access affects how confidently this directory can assess a study, not the study's underlying quality. Blinding is reported separately because it is not relevant to every design.

Design transparency · 2/2

Based on the reported study design in the retrieved source.

Sample and setting · 1/1

The sample context is stated; a numerical count is preserved only when reported.

Outcome clarity · 1/1

The finding is summarized from publisher or article metadata.

Access for checking · 0.5/1

Only abstract or bibliographic access was confirmed.

Double-blind? The retrieved publisher record does not establish whether participants or outcome assessors were blinded.