Software logs provide a rich source of data for tracing, debugging, and detecting software bugs. However, the valuable data contained within logs attached to vulnerability reports remains largely unexplored. This study aims to bridge this gap by investigating the characteristics, rationales, and potential of logs for software vulnerability management. We conduct a comprehensive analysis of 1,118 Common Vulnerabilities and Exposures (CVEs) linked to issue reports, specifically focusing on the distribution and content of logs included in these reports. Our analysis reveals that exception logs are the most prevalent type across various vulnerability categories and life cycle phases. In addition, we further discover seven key rationales for attaching logs to vulnerability reports, highlighting the multifaceted role of logs in vulnerability reporting and analysis. Furthermore, we explore the feasibility of using logs to assist in vulnerability management, specifically for vulnerability location and security issue detection. Our experiments show that exception logs effectively target at least one vulnerable function in 65.6% of analyzed vulnerabilities. To support security issue detection, we apply three different approaches, i.e., heuristic rule-based, K-means++, and Latent Dirichlet Allocation. We evaluate the three approaches on a total of 158,730 issue reports from 72 projects hosted on GitHub and Bugzilla. The results show that heuristic rule-based and K-means++ approaches successfully identify true security issues, with a precision of 44.1% and 46.7% respectively. Overall, our findings highlight the significant potential of analyzing logs in vulnerability reports to strengthen software security practices and inspire future studies.

Modern code generation tools utilizing AI models like Large Language Models have gained increased popularity due to their ability to produce functional code. However, their usage presents security challenges, often resulting in insecure code merging into the code base. Thus, evaluating the quality of generated code, especially its security, is crucial. While prior research explored various aspects of code generation, the focus on security has been limited, mostly examining code produced in controlled environments rather than open source development scenarios. To address this gap, we conducted an empirical study, analyzing code snippets generated by GitHub Copilot and two other AI code generation tools (i.e., CodeWhisperer and Codeium) from GitHub projects. Our analysis identified 733 snippets, revealing a high likelihood of security weaknesses, with 29.5% of Python and 24.2% of JavaScript snippets affected. These issues span 43 Common Weakness Enumeration (CWE) categories, including significant ones like CWE-330: Use of Insufficiently Random Values , CWE-94: Improper Control of Generation of Code , and CWE-79: Cross-site Scripting . Notably, eight of those CWEs are among the 2023 CWE Top-25, highlighting their severity. We further examined using Copilot Chat to fix security issues in Copilot-generated code by providing Copilot Chat with warning messages from the static analysis tools, and up to 55.5% of the security issues can be fixed. We finally provide the suggestions for mitigating security issues in generated code.