@demo {2025:apiace:vissoft,
	title = {EVOSCAT: Exploring Software Change Dynamics in Large-Scale Historical Datasets},
	year = {2025},
	month = {September},
	publisher = {IEEE},
	address = {Auckland, New Zealand},
	abstract = {Long lived software projects encompass a large number of artifacts, which undergo many revisions throughout their history. Empirical software engineering researchers studying software evolution gather and collect datasets with millions of events, representing changes introduced to specific artifacts. In this paper, we propose EVOSCAT, a tool that attempts addressing temporal scalability through the usage of interactive density scatterplot to provide a global overview of large historical datasets mined from open source repositories in a single visualization.  EVOSCAT intends to provide researchers with a mean to produce scalable visualizations that can help them explore and characterize evolutions datasets, as well as comparing the histories of individual artifacts, both in terms of 1) observing how rapidly different artifacts age over multiple-year-long time spans 2) how often metrics associated with each artifacts tend towards an improvement or worsening. The paper shows how the tool can be tailored to specific analysis needs (pace of change comparison, clone detection, freshness assessment) thanks to its support for flexible configuration of history scaling and alignment along the time axis, artifacts sorting and interactive color mapping, enabling the analysis of millions of events obtained by mining the histories of tens of thousands of software artifacts. We include in this paper a gallery showcasing datasets gathering specific artifacts (OpenAPI descriptions, GitHub workflow definitions) across multiple repositories, as well as diving into the history of specific popular open source projects.},
	keywords = {Interactive Scatterplot, Large-Scale Historical Data, Software Evolution Visualization},
	url = {https://arxiv.org/abs/2508.10852},
	author = {Souhaila Serbout and Diana Carolina Mu{\~n}oz Hurtado and Hassan Atwi and Edoardo Riggio and Cesare Pautasso}
}
@conference {2025:profes,
	title = {Pipelines Under Pressure: An Empirical Study of Security Misconfigurations of GitHub Workflows},
	booktitle = {26th International Conference on Product-Focused Software Process Improvement (PROFES)},
	year = {2025},
	month = {December},
	address = {Salerno, Italy},
	abstract = {Continuous Integration and Continuous Deployment (CI/ CD) pipelines have grown in popularity in recent years and are essential in streamlining the process of development and deployment of high quality software. However, developers often overlook security concerns in CI/CD pipelines, opening the door to many vulnerabilities. This paper presents an empirical investigation of nine security misconfigurations sourced from a comprehensive review of security guidelines, developer blogs, GitHub documentation, and prior research. To study the presence, co-occurrence and yearly trends of these security misconfigurations within current CI/CD practices, we analyzed a large dataset containing the most recent version of over 200{\textquoteright}000 GitHub workflow specification files, taken from open source repositories. To aid us in this study, we developed Soteria, a static analysis tool equipped with custom detectors that can systematically identify security misconfigurations. Given that less than 1\% of the analyzed workflows do not include any misconfiguration, our detection tool makes a contribution to raise awareness about widespread security misconfigurations. Our findings challenge conventional practices and motivate the need for an urgent shift in how security principles are systematically applied in the development and operation of CI/CD pipelines with more robust and finer-grained security controls.},
	keywords = {CI/CD Build Pipeline, DevOps, GitHub Actions, Security Misconfigurations, Workflows},
	author = {Edoardo Riggio and Cesare Pautasso}
}
