@conference {2026:fc4mc:icsa,
	title = {Changing Nothing, Yet Changing Everything: Exploring Rug Pulls in GitHub Workflows},
	booktitle = {23rd International Conference on Software Architecture (ICSA)},
	year = {2026},
	month = {June},
	publisher = {IEEE},
	organization = {IEEE},
	address = {Amsterdam, The Netherlands},
	abstract = {Software supply chain attacks have become a significant threat to modern software systems. By exploiting the complex and transitive nature of dependencies, malicious actors have been able to perform significant attacks, also taking advantage of the dynamic relationship between software components and their dependencies. In Continuous Integration and Continuous Deployment (CI/CD) ecosystems such as GitHub Actions, developers assemble workflows out of reusable Actions. However, these Actions{\textendash}in particular JavaScript ones{\textendash}come with an intricate network of dependencies. As they evolve, these dependency networks expose GitHub CI/CD pipelines to subtle vulnerabilities that may be introduced without any modification of the workflows themselves. This paper investigates such phenomenon, which we call {\textquotedblleft}rug pull{\textquotedblright} within GitHub workflows. Through formalization and an empirical analysis of real-world workflows, we characterize the propagation and persistence of such vulnerabilities as well as their remediation. Our findings highlight architectural considerations needed when designing secure yet maintainable CI/CD pipelines, emphasizing the need for careful dependency management and coordinated responsibility across the software supply chain.},
	keywords = {Security},
	author = {Edoardo Riggio and Cesare Pautasso}
}
@conference {apiace:2025:icsa,
	title = {Mining Security Documentation Practices in OpenAPI Descriptions},
	booktitle = {22nd IEEE International Conference on Software Architecture (ICSA)},
	year = {2025},
	month = {March},
	address = {Odense, Denmark},
	abstract = {Security is an integral requirement of any trustworthy software architecture, particularly critical for application programming interfaces (APIs). In this paper, we survey security documentation practices, specifically API security schemes related to authentication and authorization, by mining a large collection of OpenAPI descriptions retrieved from open-source GitHub repositories. Our study focuses on detecting existing security schemes and evaluating their prevalence and positioning within API descriptions. We distinguish whether security schemes are introduced locally (at the path or operation level) or globally (for the entire API). Our analysis highlights scenarios where security schemes are featured in APIs in different proportions over time, thus tracking whether the API documentation tends to include more (or less) security details as the API evolves.},
	keywords = {API Analytics, OpenAPI, Security},
	author = {Diana Carolina Mu{\~n}oz Hurtado and Souhaila Serbout and Cesare Pautasso}
}
