Security is an integral requirement of any trustworthy software architecture, particularly critical for application programming interfaces (APIs). In this paper, we survey security documentation practices, specifically API security schemes related to authentication and authorization, by mining a large collection of OpenAPI descriptions retrieved from open-source GitHub repositories. Our study focuses on detecting existing security schemes and evaluating their prevalence and positioning within API descriptions. We distinguish whether security schemes are introduced locally (at the path or operation level) or globally (for the entire API). Our analysis highlights scenarios where security schemes are featured in APIs in different proportions over time, thus tracking whether the API documentation tends to include more (or less) security details as the API evolves.

Long lived software projects encompass a large number of artifacts, which undergo many revisions throughout their history. Empirical software engineering researchers studying software evolution gather and collect datasets with millions of events, representing changes introduced to specific artifacts. In this paper, we propose EvoScat, a tool that attempts addressing temporal scalability through the usage of interactive density scatterplot to provide a global overview of large historical datasets mined from open source repositories in a single visualization. EvoScat intents to provide researchers with a mean to produce scalable visualizations that can help them explore and characterize evolutions datasets, as well as comparing the histories of individual artifacts, both in terms of 1) observing how rapidly different artifacts age over multiple-year-long time spans 2) how often metrics associated with each artifacts tend towards an improvement or worsening. The paper shows how the tool can be tailored to specific analysis needs (pace of change comparison, clone detection, freshness assessment) thanks to its support for flexible configuration of history scaling and alignment along the time axis, artifacts sorting and interactive color mapping, enabling the analysis of millions of events obtained by mining the histories of tens of thousands of software artifacts. We include in this paper a gallery showcasing datasets gathering specific artifacts (OpenAPI descriptions, GitHub workflow definitions) across multiple repositories, as well as diving into the history of specific popular open source projects.

Application Programming Interfaces (APIs) evolve over time. As they change, they are expected to be versioned based on how changes might affect their clients. In this paper, we present two novel visualizations specifically designed to represent all structural changes and the level of adherence to semantic versioning practices over time. They can also serve for characterizing and comparing the evolution history of different Web APIs. The API Version Clockhelps to visualize the sequence of API changes over time and highlight inconsistencies between major, minor, or patch version changes and the corresponding introduced breaking or non-breaking changes applied to the API. The API Changesoverview aggregates all changes to an OpenAPI (OAS) description, highlighting the unstable vs. the stable elements of the API over its entire history. Both visualizations can be automatically created using the APIcTURE, a command-line and web-based tool that analyzes the histories of git code repositories containing OAS descriptions, extracting the necessary data for generating visualizations and computing metrics related to API evolution and versioning. The visualizations have been successfully applied to classify, compare, and interactively explore the multi-year evolution history of APIs with up to hundreds of individual commits. Video URL: https://youtu.be/WtFm6VvKi20