Demo Data from EDBT 2026 / reviewers in the wild / expert
Steven Ngo
dblp:387/3595
· DBLP profile ↗
1ranked-venue papers
0as first author
1since 2021 · last 2025
0009-0009-1871-5825ORCID · reported
Domains — the database's venue-derived domains; a paper can count in several
Security and privacy · 1 · 1 since 2021
Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.
| Software engineering, system software, and programming languages
1 paper |
Empirical software engineering · 50% Software maintenance and evolution · 50% | |
| Network and information security
1 paper |
Systems and software security · 100% |
Topics — the 3 heaviest of 4, each with the papers that count most for it
| Topic | Weight | Papers | Last | Evidence papers |
|---|---|---|---|---|
Empirical software engineering
developer studies |
0.9 | 1 | 2025 | A Deep Dive into How Open-Source Project Maintainers Review and Resolve Bug Bounty Reports · SP 2025 |
Systems and software security › vulnerability management
bug bounty programs |
0.3 | 1 | 2025 | A Deep Dive into How Open-Source Project Maintainers Review and Resolve Bug Bounty Reports · SP 2025 |
Systems and software security › vulnerability management
vulnerability disclosure |
0.3 | 1 | 2025 | A Deep Dive into How Open-Source Project Maintainers Review and Resolve Bug Bounty Reports · SP 2025 |
Methods — techniques the papers use, named apart from their topics
survey · 1.7semi-structured interviews · 1.7likert-scale analysis · 1.7
| Year | Publication | Venue | Position |
|---|---|---|---|
| 2025 | A Deep Dive into How Open-Source Project Maintainers Review and Resolve Bug Bounty ReportsabstractResearchers have investigated the bug bounty ecosystem from the lens of platforms, programs, and bug hunters. Understanding the perspectives of bug bounty report reviewers, especially those who historically lack a security background and little to no funding for bug hunters, is currently under-studied. In this paper, we primarily investigate the perspective of open-source software (OSS) maintainers who have used huntr, a bug bounty platform that pays bounties to bug hunters who find security bugs in GitHub projects and have had valid vulnerabilities patched as a result. We address this area by conducting three studies: identifying characteristics through a listing survey$(n_{1}=51)$, their ranked importance with Likert-scale survey data$(n_{2}=90)$, and conducting semi-structured interviews to dive deeper into real-world experiences$(n_{3} =17)$. As a result, we categorize 40 identified characteristics into benefits, challenges, helpful features, and wanted features. We find that private disclosure and project visibility are the most important benefits, while hunters focused on money or CVEs and pressure to review are the most challenging to overcome. Surprisingly, lack of communication with bug hunters is the least challenging, and CVE creation support is the second-least helpful feature for OSS maintainers when reviewing bug bounty reports. We present recommendations to make the bug bounty review process more accommodating to open-source maintainers and identify areas for future work. Jessy Ayala, Steven Ngo, Joshua Garcia |
SP | 2 |