Mohammad Hamdaqa

Backporting changes to stable releases is a critical yet high-stakes maintenance task. In practice, large-scale ecosystems like Open-Stack rely on explicit governance rules for stable branches, where many repositories enforce that changes cannot be merged or released without an explicit backport-related vote (e.g., Backport-Candidate). However, identifying changes that are safe to back-port remains largely manual, leading to significant decision latency and inconsistency. To alleviate this challenge, we present BackportCheck, a decision-support tool implemented as a Chrome extension for the Gerrit code review interface. BackportCheck is based on a Gradient Boosting model (XGBoost), trained on historical process data, combined with a Large Language Model (LLM) that generates concise, human-readable justifications for predicted backport decisions. We evaluate BackportCheck for both usefulness and usability across 3,422 OpenStack changes, achieving 81.31% accuracy while maintaining a mean end-to-end response time of 1.39 seconds, outperforming CodeBERT-based classifiers and standalone LLMs. BackportCheck is available via GitHub¹. A video demonstrating the tool usage is available on YouTube².

AI-driven software systems are increasingly developed through rapid, iterative practices that combine large language models, prompt engineering, and ad-hoc integration of external tools and services; a style often described as vibe coding. While these practices enable fast experimentation and deployment, they challenge the basic principles of software engineering. Documentation is informal and quickly outdated, requirements are often implicit, and code review and testing are applied to artifacts that only partially determine system behavior. As a result, critical questions about whether a system behaved as intended, permitted, or prohibited cannot be reliably answered after deployment. This paper presents a vision for spec-driven, contract-based AIWare systems in which specifications function as explicit communicative commitments defining required, permitted, and forbidden behavior. We argue that auditability cannot be achieved through code review alone, and instead requires specifications that are enforceable across continuous integration and deployment (CI/CD) pipelines, runtime execution, and post-hoc audit. We introduce a contract-driven framework structured around specification, execution, and audit planes, extend it with spec-driven CI/CD integration, and illustrate the approach through walkthrough examples. Our vision reframes auditability as a first-class system property and specifications as the authoritative source of correctness in AIWare systems.

AI code agents are increasingly used to generate software changes, raising questions about whether their outputs can be trusted. We investigate this by quantifying security issues in agent-generated code using a repository-level Static Application Security Testing (SAST) pipeline. We analyze 7,200 Agent Pull Requests (APRs) and 6,620 Human Pull Requests (HPRs) from 818 repositories with at least 500 GitHub stars, using four SAST engines to assess the introduction and severity of Common Weakness Enumeration (CWE) indicators. Our results show that agents introduce security risks (RQ1), including critical weaknesses such as hard-coded credentials and command injection. However, security performance varies across agents and task types, with statistically significant differences emerging for specific tasks (RQ2). Comparing agents to humans (RQ3), we find that agents introduce fewer or less severe issues on small, focused bug fixes, while differences on larger pull requests are task-dependent and driven by a small number of high-impact changes rather than systematic performance gaps. Overall, agent-generated code is neither uniformly secure nor insecure; its safety depends on task context, emphasizing the need for task-aware deployment and human-oversight.

Smart contract security audits are essential for trust in decentralized finance (DeFi), yet audit reports from different firms vary widely in scope definition, severity labels, fix verification, and report structure. These differences make it hard for developers, users, and other stakeholders to assess risk. In this paper, we address these issues by empirically analyzing 160 audit reports from 26 leading auditing firms to uncover patterns and gaps in current practices. Using qualitative content analysis, we extract a taxonomy of 19 common properties that audit reports include (or omit). We then apply Formal Concept Analysis (FCA) to identify five distinct “report style families” used by auditors, and perform a temporal trend analysis to see if the industry is converging on certain best practices. Finally, we synthesize a feature model that specifies a minimal defensible baseline for audit reports, distinguishing mandatory sections from optional extensions to support traceability and consistent interpretation across reports. This model enables reproducible comparisons across auditors, strengthens accountability for scope definition and fix verification, and provides an evidence base to improve the quality and uniformity of smart contract audit reporting.

Code refactoring is a fundamental software engineering practice aimed at improving code quality and maintainability. Despite its importance, developers often neglect refactoring due to the significant time, effort, and resources it requires, as well as the lack of immediate functional rewards. Although several automated refactoring tools have been proposed, they remain limited in supporting a broad spectrum of refactoring types. In this study, we explore whether instruction strategies inspired by human best-practice guidelines can enhance the ability of Large Language Models (LLMs) to perform diverse refactoring tasks automatically. Leveraging the instruction-following and code comprehension capabilities of state-of-the-art LLMs (e.g., GPT-mini and DeepSeek-V3), we draw on Martin Fowler's refactoring guidelines to design multiple instruction strategies that encode motivations, procedural steps, and transformation objectives for 61 well-known refactoring types. We evaluate these strategies on benchmark examples and real-world code snippets from GitHub projects. Our results show that instruction designs grounded in Fowler's guidelines enable LLMs to successfully perform all benchmark refactoring types and preserve program semantics in real-world settings, an essential criterion for effective refactoring. Moreover, while descriptive instructions are more interpretable to humans, our results show that rule-based instructions often lead to better performance in specific scenarios. Interestingly, allowing models to focus on the overall goal of refactoring, rather than prescribing a fixed transformation type, can yield even greater improvements in code quality.