{"id":"https://openalex.org/W7127968018","doi":"https://doi.org/10.1145/3793302.3793360","title":"Characterizing and Modeling the GitHub Security Advisories Review Pipeline","display_name":"Characterizing and Modeling the GitHub Security Advisories Review Pipeline","publication_year":2026,"publication_date":"2026-04-13","ids":{"openalex":"https://openalex.org/W7127968018","doi":"https://doi.org/10.1145/3793302.3793360"},"language":null,"primary_location":{"id":"doi:10.1145/3793302.3793360","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3793302.3793360","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 23rd International Conference on Mining Software Repositories","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3793302.3793360","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5125124393","display_name":"Claudio Segal","orcid":null},"institutions":[{"id":"https://openalex.org/I161127581","display_name":"Universidade Federal Fluminense","ror":"https://ror.org/02rjhbb08","country_code":"BR","type":"education","lineage":["https://openalex.org/I161127581"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Claudio Marcos Durand Segal","raw_affiliation_strings":["Institute of Computing, UFF, Niteroi, RJ, Brazil"],"raw_orcid":"https://orcid.org/0009-0000-4101-4191","affiliations":[{"raw_affiliation_string":"Institute of Computing, UFF, Niteroi, RJ, Brazil","institution_ids":["https://openalex.org/I161127581"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125227258","display_name":"Paulo Segal","orcid":null},"institutions":[{"id":"https://openalex.org/I161127581","display_name":"Universidade Federal Fluminense","ror":"https://ror.org/02rjhbb08","country_code":"BR","type":"education","lineage":["https://openalex.org/I161127581"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Paulo Marcos Durand Segal","raw_affiliation_strings":["Institute of Computing, UFF, Niteroi, RJ, Brazil"],"raw_orcid":"https://orcid.org/0009-0000-3265-3047","affiliations":[{"raw_affiliation_string":"Institute of Computing, UFF, Niteroi, RJ, Brazil","institution_ids":["https://openalex.org/I161127581"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125163219","display_name":"Carlos Eduardo de Schuller Banjar","orcid":null},"institutions":[{"id":"https://openalex.org/I40034438","display_name":"Universidade do Estado do Rio de Janeiro","ror":"https://ror.org/0198v2949","country_code":"BR","type":"education","lineage":["https://openalex.org/I40034438"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Carlos Eduardo de Schuller Banjar","raw_affiliation_strings":["Institute of Computing, UFRJ, Rio de Janeiro, RJ, Brazil"],"raw_orcid":"https://orcid.org/0000-0003-1576-3863","affiliations":[{"raw_affiliation_string":"Institute of Computing, UFRJ, Rio de Janeiro, RJ, Brazil","institution_ids":["https://openalex.org/I40034438"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5087728351","display_name":"Felipe P. Paix\u00e3o","orcid":null},"institutions":[{"id":"https://openalex.org/I44314228","display_name":"Universidade Salvador","ror":"https://ror.org/01afz2176","country_code":"BR","type":"education","lineage":["https://openalex.org/I44314228"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Felipe de Sant'Anna Paix\u00e3o","raw_affiliation_strings":["Institute of Computing, UFBA, Salvador, BA, Brazil"],"raw_orcid":"https://orcid.org/0009-0009-7370-5478","affiliations":[{"raw_affiliation_string":"Institute of Computing, UFBA, Salvador, BA, Brazil","institution_ids":["https://openalex.org/I44314228"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125255968","display_name":"Hudson Silva Borges","orcid":null},"institutions":[{"id":"https://openalex.org/I122558511","display_name":"Universidade Federal de Mato Grosso do Sul","ror":"https://ror.org/0366d2847","country_code":"BR","type":"education","lineage":["https://openalex.org/I122558511"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Hudson Borges","raw_affiliation_strings":["UFMS, Campo Grande, MS, Brazil"],"raw_orcid":"https://orcid.org/0000-0002-8325-8773","affiliations":[{"raw_affiliation_string":"UFMS, Campo Grande, MS, Brazil","institution_ids":["https://openalex.org/I122558511"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5032866658","display_name":"Paulo Silveira Neto","orcid":null},"institutions":[{"id":"https://openalex.org/I62921916","display_name":"Universidade Federal Rural de Pernambuco","ror":"https://ror.org/02ksmb993","country_code":"BR","type":"education","lineage":["https://openalex.org/I62921916"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Paulo Silveira Neto","raw_affiliation_strings":["Federal University Rural of Pernambuco, Recife, PE, Brazil"],"raw_orcid":"https://orcid.org/0000-0003-0197-8249","affiliations":[{"raw_affiliation_string":"Federal University Rural of Pernambuco, Recife, PE, Brazil","institution_ids":["https://openalex.org/I62921916"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125221281","display_name":"Eduardo Santana de Almeida","orcid":null},"institutions":[{"id":"https://openalex.org/I126158947","display_name":"Universidade Federal da Bahia","ror":"https://ror.org/03k3p7647","country_code":"BR","type":"education","lineage":["https://openalex.org/I126158947"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Eduardo Santana de Almeida","raw_affiliation_strings":["Institute of Computing, Federal University of Bahia (UFBA), Salvador, BA, Brazil"],"raw_orcid":"https://orcid.org/0000-0002-9312-6715","affiliations":[{"raw_affiliation_string":"Institute of Computing, Federal University of Bahia (UFBA), Salvador, BA, Brazil","institution_ids":["https://openalex.org/I126158947"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043541139","display_name":"Joanna C. S. Santos","orcid":"https://orcid.org/0000-0001-8743-2516"},"institutions":[{"id":"https://openalex.org/I107639228","display_name":"University of Notre Dame","ror":"https://ror.org/00mkhxb43","country_code":"US","type":"education","lineage":["https://openalex.org/I107639228"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Joanna C.S. Santos","raw_affiliation_strings":["University of Notre Dame, South Bend, IN, USA"],"raw_orcid":"https://orcid.org/0000-0001-8743-2516","affiliations":[{"raw_affiliation_string":"University of Notre Dame, South Bend, IN, USA","institution_ids":["https://openalex.org/I107639228"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125163202","display_name":"Anton Kocheturov","orcid":null},"institutions":[{"id":"https://openalex.org/I4210137693","display_name":"Siemens (United States)","ror":"https://ror.org/04axb7e79","country_code":"US","type":"company","lineage":["https://openalex.org/I1325886976","https://openalex.org/I4210137693"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Anton Kocheturov","raw_affiliation_strings":["Siemens, Princeton, NJ, USA"],"raw_orcid":"https://orcid.org/0000-0003-2549-9146","affiliations":[{"raw_affiliation_string":"Siemens, Princeton, NJ, USA","institution_ids":["https://openalex.org/I4210137693"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101960104","display_name":"Gaurav Kumar Srivastava","orcid":"https://orcid.org/0000-0002-2597-7542"},"institutions":[{"id":"https://openalex.org/I4210137693","display_name":"Siemens (United States)","ror":"https://ror.org/04axb7e79","country_code":"US","type":"company","lineage":["https://openalex.org/I1325886976","https://openalex.org/I4210137693"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Gaurav Kumar Srivastava","raw_affiliation_strings":["Siemens, Princeton, NJ, USA"],"raw_orcid":"https://orcid.org/0009-0005-2755-629X","affiliations":[{"raw_affiliation_string":"Siemens, Princeton, NJ, USA","institution_ids":["https://openalex.org/I4210137693"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5125124175","display_name":"Daniel Sadoc Menasch\u00e9","orcid":null},"institutions":[{"id":"https://openalex.org/I122140584","display_name":"Universidade Federal do Rio de Janeiro","ror":"https://ror.org/03490as77","country_code":"BR","type":"education","lineage":["https://openalex.org/I122140584"]},{"id":"https://openalex.org/I40034438","display_name":"Universidade do Estado do Rio de Janeiro","ror":"https://ror.org/0198v2949","country_code":"BR","type":"education","lineage":["https://openalex.org/I40034438"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Daniel Sadoc Menasch\u00e9","raw_affiliation_strings":["Institute of Computing, UFRJ, Rio de Janeiro, Rio de Janeiro, Brazil"],"raw_orcid":"https://orcid.org/0000-0002-8953-4003","affiliations":[{"raw_affiliation_string":"Institute of Computing, UFRJ, Rio de Janeiro, Rio de Janeiro, Brazil","institution_ids":["https://openalex.org/I122140584","https://openalex.org/I40034438"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":9,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.13141929,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"311","last_page":"322"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.4936000108718872,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.4936000108718872,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.20069999992847443,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.07980000227689743,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.6439999938011169},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.6205999851226807},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5198000073432922},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.49459999799728394},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.4763999879360199},{"id":"https://openalex.org/keywords/path","display_name":"Path (computing)","score":0.4652999937534332},{"id":"https://openalex.org/keywords/fraction","display_name":"Fraction (chemistry)","score":0.3653999865055084}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7077999711036682},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.6439999938011169},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.6205999851226807},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5198000073432922},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.49459999799728394},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.4763999879360199},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.4652999937534332},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.454800009727478},{"id":"https://openalex.org/C149629883","wikidata":"https://www.wikidata.org/wiki/Q660926","display_name":"Fraction (chemistry)","level":2,"score":0.3653999865055084},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.3619999885559082},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.29809999465942383},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.27320000529289246},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.271699994802475},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.26759999990463257},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.2637999951839447},{"id":"https://openalex.org/C22684755","wikidata":"https://www.wikidata.org/wiki/Q847526","display_name":"Queueing theory","level":2,"score":0.2624000012874603},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.25040000677108765},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.2502000033855438}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3793302.3793360","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3793302.3793360","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 23rd International Conference on Mining Software Repositories","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2602.06009","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2602.06009","pdf_url":"https://arxiv.org/pdf/2602.06009","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"doi:10.1145/3793302.3793360","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3793302.3793360","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 23rd International Conference on Mining Software Repositories","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1840770272","display_name":null,"funder_award_id":"E-26/","funder_id":"https://openalex.org/F4320322749","funder_display_name":"Funda\u00e7\u00e3o Carlos Chagas Filho de Amparo \u00e0 Pesquisa do Estado do Rio de Janeiro"},{"id":"https://openalex.org/G216040750","display_name":null,"funder_award_id":"444956/2024-7","funder_id":"https://openalex.org/F4320335874","funder_display_name":"CNPC Chuanqing Drilling Engineering Company Limited"},{"id":"https://openalex.org/G933372841","display_name":null,"funder_award_id":"E_26/204","funder_id":"https://openalex.org/F4320322749","funder_display_name":"Funda\u00e7\u00e3o Carlos Chagas Filho de Amparo \u00e0 Pesquisa do Estado do Rio de Janeiro"}],"funders":[{"id":"https://openalex.org/F4320321091","display_name":"Coordena\u00e7\u00e3o de Aperfei\u00e7oamento de Pessoal de N\u00edvel Superior","ror":"https://ror.org/00x0ma614"},{"id":"https://openalex.org/F4320322025","display_name":"Conselho Nacional de Desenvolvimento Cient\u00edfico e Tecnol\u00f3gico","ror":"https://ror.org/03swz6y49"},{"id":"https://openalex.org/F4320322749","display_name":"Funda\u00e7\u00e3o Carlos Chagas Filho de Amparo \u00e0 Pesquisa do Estado do Rio de Janeiro","ror":"https://ror.org/03kk0s825"},{"id":"https://openalex.org/F4320324265","display_name":"Instituto Nacional de Ci\u00eancia e Tecnologia para Engenharia de Software","ror":"https://ror.org/00c70d758"},{"id":"https://openalex.org/F4320335874","display_name":"CNPC Chuanqing Drilling Engineering Company Limited","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"GitHub":[0,93],"Security":[1],"Advisories":[2,95],"(GHSA)":[3],"have":[4],"become":[5],"a":[6,30,54,88,98,108],"central":[7],"component":[8],"of":[9,25,32,58,120],"open-source":[10],"vulnerability":[11],"disclosure":[12],"and":[13,19,82,97],"are":[14,34,73],"widely":[15],"used":[16],"by":[17,36,92,102],"developers":[18],"security":[20],"tools.":[21],"A":[22],"distinctive":[23],"feature":[24],"GHSA":[26,60],"is":[27],"that":[28,111],"only":[29],"fraction":[31],"advisories":[33,66,72],"reviewed":[35],"GitHub,":[37],"while":[38],"the":[39,59,118,121],"mechanisms":[40],"associated":[41],"with":[42],"this":[43,50,114],"review":[44,61,80],"process":[45],"remain":[46],"poorly":[47],"understood.":[48],"In":[49],"paper,":[51],"we":[52],"conduct":[53],"large-scale":[55],"empirical":[56],"study":[57],"processes,":[62],"analyzing":[63],"over":[64],"288,000":[65],"spanning":[67],"2019-2025.":[68],"We":[69,105],"characterize":[70],"which":[71],"more":[74],"likely":[75],"to":[76],"be":[77],"reviewed,":[78],"quantify":[79],"delays,":[81],"identify":[83],"two":[84],"distinct":[85],"review-latency":[86],"regimes:":[87],"fast":[89],"path":[90,100],"dominated":[91,101],"Repository":[94],"(GRAs)":[96],"slow":[99],"NVD-first":[103],"advisories.":[104],"further":[106],"develop":[107],"queueing":[109],"model":[110],"accounts":[112],"for":[113],"dichotomy":[115],"based":[116],"on":[117],"structure":[119],"advisory":[122],"processing":[123],"pipeline.":[124]},"counts_by_year":[],"updated_date":"2026-08-18T07:49:30.821534","created_date":"2026-02-07T00:00:00"}