Exploring the SECURITY.md in the Dependency Chain: Preliminary Analysis of the PyPI Ecosystem
Issued Date
2025-01-01
Resource Type
Scopus ID
2-s2.0-105033707263
Journal Title
Proceedings 2025 40th IEEE ACM International Conference on Automated Software Engineering Workshops Asew 2025
Start Page
260
End Page
267
Rights Holder(s)
SCOPUS
Bibliographic Citation
Proceedings 2025 40th IEEE ACM International Conference on Automated Software Engineering Workshops Asew 2025 (2025) , 260-267
Suggested Citation
Termphaiboon C., Kula R.G., Fan Y., Choetkiertikul M., Ragkhitwetsagul C., Sunetnanta T., Matsumoto K. Exploring the SECURITY.md in the Dependency Chain: Preliminary Analysis of the PyPI Ecosystem. Proceedings 2025 40th IEEE ACM International Conference on Automated Software Engineering Workshops Asew 2025 (2025) , 260-267. 267. doi:10.1109/ASEW67777.2025.00055 Retrieved from: https://repository.li.mahidol.ac.th/handle/123456789/116025
Title
Exploring the SECURITY.md in the Dependency Chain: Preliminary Analysis of the PyPI Ecosystem
Author's Affiliation
Corresponding Author(s)
Other Contributor(s)
Abstract
Security policies, such as SECURITY.md files, are now common in open-source projects. They help guide responsible vulnerability reporting and build trust among users and contributors. Despite their growing use, it is still unclear how these policies influence the structure and evolution of software dependencies. Software dependencies are external packages or libraries that a project relies on, and their interconnected nature affects both functionality and security. This study explores the relationship between security policies and dependency management in PyPI projects. We analyzed projects with and without a SECURITY.md file by examining their dependency trees and tracking how dependencies change over time. The analysis shows that projects with a security policy tend to rely on a broader set of direct dependencies, while overall depth and transitive dependencies remain similar. Historically, projects created after the introduction of SECURITY.md, particularly later adopters, show more frequent dependency updates. These results suggest that security policies are linked to more modular and feature-rich projects, and highlight the role of SECURITY.md in promoting proactive dependency management and reducing risks in the software supply chain.