Committed to Trust: A Qualitative Study on Security & Trust in Open Source Software Projects
Open accessAbstract
Open Source Software plays an important role in many software ecosystems. Whether in operating systems, network stacks, or as low-level system drivers, software we encounter daily is permeated with code contributions from open source projects. Decentralized development and open collaboration in open source projects introduce unique challenges: code submissions from unknown entities, limited personpower for commit or dependency reviews, and bringing new contributors up-to-date in projects’ best practices & processes.In 27 in-depth, semi-structured interviews with owners, maintainers, and contributors from a diverse set of open source projects, we investigate their security and trust practices. For this, we explore projects’ behind-the-scene processes, provided guidance & policies, as well as incident handling & encountered challenges. We find that our participants’ projects are highly diverse both in deployed security measures and trust processes, as well as their underlying motivations. Based on our findings, we discuss implications for the open source software ecosystem and how the research community can better support open source projects in trust and security considerations. Overall, we argue for supporting open source projects in ways that consider their individual strengths and limitations, especially in the case of smaller projects with low contributor numbers and limited access to resources.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The number of GitHub stars is widely used when stakeholders evaluate, select, and adopt open-source projects into their software supply chain.
“Many studies provided evidence that the number of GitHub stars is widely used when stakeholders evaluate, select, and adopt opensource projects into their software supply chain [33, 61, 71, 76, 89, 95].”
From Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware (2026) · cites this paper as [95]
Practitioners use star counts as an important (and often the most important) signal for decisions, including high-stakes decisions like open-source component adoption and repository reputation evaluation.
“Yet, study after study shows how practitioners use star counts as an important (and often as the most important) signal for all kinds of decisions, including high-stakes decisions like open-source component adoption [69, 89, 95] and repository reputation evaluation [76, 88].”
From Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware (2026) · cites this paper as [95]
The citation lists haven’t been fetched yet
References 95 · Cited by 42
- Authors
- Wermke, D., Wöhler, N., Klemmer, J. H., Fourné, M., Acar, Y., & Fahl, S.
- Affiliations
- Helmholtz Center for Information Security (DE)
- Leibniz University Hannover (DE)
- Max Planck Institute for Security and Privacy (DE)
- George Washington University (US)
- Venue
- 2022 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2022-05
- Pages
- 1880-1896
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W4288057810
- Cited by
- 42
- References
- 95
- Citations by year
- 2026: 8 · 2025: 11 · 2024: 11 · 2023: 11 · 2022: 1
- FWCI
- 11.09
- Type
- conference paper
- Language
- en
- Open access
- green
- doi.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- Leibniz Universität Hannover (cc-by-sa)
- Topics
- Physical Sciences › Computer Science › Computer Science Applications › Open Source Software Innovations
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- open source software, software security, trust, contributor onboarding, code review, incident response, decentralized development, security policy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
