Abstract Domain-specific languages (DSL) are programming or modeling languages
devoted to a given application domain. There are many tools used to support the …

AI code assistants have emerged as powerful tools that can aid in the software development
life-cycle and can improve developer productivity. Unfortunately, such assistants have also …

The Java platform provides various cryptographic APIs to facilitate secure coding. However,
correctly using these APIs is challenging for developers who lack cybersecurity training …

Practitioners use infrastructure as code (IaC) scripts to provision servers and development
environments. While developing IaC scripts, practitioners may inadvertently introduce …

Embedded devices are increasingly ubiquitous in our society. Firmware updates are one of
the primary mechanisms to mitigate vulnerabilities in embedded systems. However, the …

Timing attacks are among the most devastating side-channel attacks, allowing remote
attackers to retrieve secret material, including cryptographic keys, with relative ease. In …

Cryptographic API misuses, such as exposed secrets, predictable random numbers, and
vulnerable certificate verification, seriously threaten software security. The vision of …

Reverse engineering is a complex process essential to software-security tasks such as
vulnerability discovery and malware analysis. Significant research and engineering effort …

Precise static analyses are context-, field-and flow-sensitive. Context-and field-sensitivity are
both expressible as context-free language (CFL) reachability problems. Solving both CFL …

Secure software development is a challenging task requiring consideration of many possible
threats and mitigations. This paper investigates how and why programmers, despite a …