Background: Sensitive Information Exposure (SIEx) vulnerabilities (CWE-200) remain a persistent and underaddressed threat across software systems, often leading to serious security breaches. Existing detection tools rarely target the diverse subcategories of CWE-200 or provide context-aware analysis of code-level data flows. Aims: This paper aims to present SIExVulTS, a novel vulnerability detection system that integrates transformer-based models with static analysis to identify and verify sensitive information exposure in Java applications. Method: SIExVulTS employs a three-stage architecture: (1) an Attack Surface Detection Engine that uses sentence embeddings to identify sensitive variables, strings, comments, and sinks; (2) an Exposure Analysis Engine that instantiates CodeQL queries aligned with the CWE-200 hierarchy; and (3) a Flow Verification Engine that leverages GraphCodeBERT to semantically validate source-to-sink flows. We evaluate SIExVulTS using three curated datasets, including real-world CVEs, a benchmark set of synthetic CWE-200 examples, and labeled flows from 31 open-source projects. Results: The Attack Surface Detection Engine achieved an average$\mathbf{F 1}$score greater than$\mathbf{9 3 \%}$, the Exposure Analysis Engine achieved an F 1 score of 85.71 %, and the Flow Verification Engine increased precision from 22.61 % to 87.23 %. Moreover, SIExVulTS successfully uncovered six previously unknown CVEs in major Apache projects. Conclusions: The results demonstrate that SIExVulTS is effective and practical for improving software security against sensitive data exposure, addressing limitations of existing tools in detecting and verifying CWE-200 vulnerabilities.

Over the past three decades software engineering researchers have produced a wide range of techniques and tools for understanding the architectures of large, complex systems. However, these have tended to be one-off research projects, and their idiosyncratic natures have hampered research collaboration, extension and combination of the tools, and technology transfer. The area of software architecture is rich with disjoint research and development infrastructures, and datasets that are either proprietary or captured in proprietary formats. This paper describes a concerted effort to reverse these trends. We have designed and implemented a flexible and extensible infrastructure (SAIN) with the goal of sharing, replicating, and advancing software architecture research. We have demonstrated that SAIN is capable of incorporating the constituent tools extracted from three independently developed, large, long-lived software architecture research environments. We discuss SAIN's ambitious goals, the challenges we have faced in achieving those goals, the key decisions made in SAIN's design and implementation, the lessons learned from our experience to date, and our ongoing and future work.

Automated traceability techniques based on supervised machine learning algorithms can significantly reduce the cost and effort needed to create and maintain traceability links between requirements, architecture and source code. However, the upfront cost to train these algorithms is the main bottleneck for expanding, and validating these traceability techniques as well as applying them to complex industrial systems. In this tool demo, we present our Web-based tool named BUDGET, as a solution to automate creation of training data for the problem of tracing architectural concerns. BUDGET uses Automated Web-Mining, and Big-Data Analysis techniques to generate training data for supervised architecture-traceability techniques. It uses several sampling strategies and mines ultra-large scale code repositories to generate datasets of tactical code snippets. The BUDGET falls in the research tool category and supports researchers in the area of software architecture and requirements engineering.