Exploring Technical Debt in Security Questions on Stack Overflow
Joshua Aldrich Edbert, Sahrima Jannat Oishwee, Shubhashis Karmakar,, Zadia Codabux, Roberto Verdecchia

TL;DR
This study analyzes security-related questions on Stack Overflow to understand the prevalence and characteristics of Technical Debt discussions, revealing that a significant portion of security queries involve TD and highlighting areas for developer education and security improvement.
Contribution
It is the first large-scale analysis of security-related Technical Debt questions on Stack Overflow, identifying key tags, user awareness levels, and sentiment patterns.
Findings
38% of security questions are related to Technical Debt.
Tags 'security' and 'encryption' are most common in TD questions.
Users with higher reputation scores tend to ask longer, neutral sentiment TD questions.
Abstract
Background: Software security is crucial to ensure that the users are protected from undesirable consequences such as malware attacks which can result in loss of data and, subsequently, financial loss. Technical Debt (TD) is a metaphor incurred by suboptimal decisions resulting in long-term consequences such as increased defects and vulnerabilities if not managed. Although previous studies have studied the relationship between security and TD, examining their intersection in developers' discussion on Stack Overflow (SO) is still unexplored. Aims: This study investigates the characteristics of security-related TD questions on SO. More specifically, we explore the prevalence of TD in security-related queries, identify the security tags most prone to TD, and investigate which user groups are more aware of TD. Method: We mined 117,233 security-related questions on SO and used a…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsInformation and Cyber Security · Software Engineering Research · Advanced Malware Detection Techniques
