T:Code quality & security
Code quality & security
Current source memberships across the atlas. A source can address more than one stream.
SE@PoliMi bibliography 49
- W001 — AI IDEs or Autonomous Agents? Measuring the Impact of Coding Agents on Software Development
Agarwal · 2026 - W004 — Speed at the Cost of Quality: How Cursor AI Increases Short-Term Velocity and Long-Term Complexity in Open-Source Projects
He · 2026 - W021 — The AI Engineering Report 2026: The Acceleration Whiplash
Faros AI · 2026 - W024 — 2025 State of AI-Assisted Software Development
Google Cloud DORA · 2025 - W029 — Beyond Bug Fixes: An Empirical Investigation of Post-Merge Code Quality Issues in Agent-Generated Pull Requests
Cynthia · 2026 - W030 — Workspace Topology as an Attack Vector in Agentic Coding Assistants
Day · 2026 - W031 — More Code, Less Reuse: Investigating Code Quality and Reviewer Sentiment towards AI-generated Pull Requests
Huang · 2026 - W032 — Understanding the Impact of AI Code Assistants on Security API Usage
Mousavi · 2026 - W033 — How AI Coding Agents Modify Code: A Large-Scale Study of GitHub Pull Requests
Ogenrwot · 2026 - W034 — Comparing AI Coding Agents: A Task-Stratified Analysis of Pull Request Acceptance
Pinna · 2026 - W035 — Security in the Age of AI Teammates: An Empirical Study of Agentic Pull Requests on GitHub
Siddiq · 2026 - W036 — On the Use of Agentic Coding: An Empirical Study of Pull Requests on GitHub
Watanabe · 2026 - W037 — After the Party: Growth, Governance, and Security Scanning in the OpenClaw Agent Skill Ecosystem
Xiong · 2026 - W038 — Guiding AI to Fix Its Own Flaws: An Empirical Study on LLM-Driven Secure Code Generation
Yan · 2026 - W039 — Human-Written vs. AI-Generated Code: A Large-Scale Study of Defects, Vulnerabilities, and Complexity
Cotroneo · 2025 - W040 — Security Weaknesses of Copilot-Generated Code in GitHub Projects: An Empirical Study
Fu · 2025 - W041 — Security Vulnerabilities in AI-Generated Code: A Large-Scale Analysis of Public GitHub Repositories
Schreiber · 2025 - W042 — Security Degradation in Iterative AI Code Generation: A Systematic Analysis of the Paradox
Shukla · 2025 - W043 — We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs
Spracklen · 2025 - W044 — An Empirical Study of Code Clones from Commercial AI Code Generators
Wu · 2025 - W045 — Is Vibe Coding Safe? Benchmarking Vulnerability of Agent-Generated Code in Real-World Tasks
Zhao · 2025 - W046 — Do Users Write More Insecure Code with AI Assistants?
Perry · 2023 - W047 — Lost at C: A User Study on the Security Implications of Large Language Model Code Assistants
Sandoval · 2023 - W048 — Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions
Pearce · 2022 - W049 — The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort
Churilov · 2026 - W050 — Understanding the (In)Security of Vibe-Coded Applications
Deng · 2026 - W051 — From Conversation to Contribution: Characterizing Coding Agent in Open-Source Software
Fang · 2026 - W052 — What is the Difference Between Me and You? Benchmarking the Quality Gap Between Human-Written and AI-Generated Code
Improta · 2026 - W053 — Scanning the Harness: Configuration Exposures in AI Coding-Agent Supply Chains
Kapner · 2026 - W054 — Not All Agents Are Equal: Code Quality and Post-Merge Maintenance Across Five Autonomous Coding Agents in the Wild
Kraishan · 2026 - W055 — Debt Behind the AI Boom: A Large-Scale Empirical Study of AI-Generated Code in the Wild
Liu · 2026 - W056 — A Large-Scale Comprehensive Measurement of AI-Generated Code in Real-World Repositories
Mao · 2026 - W057 — How Do AI Coding Agents Contribute to Software Development? An Empirical Study of Agentic Pull Requests
Mazloomzadeh · 2026 - W058 — Decoupling Code Complexity from Newcomer Participation: A Causal Study of AI Coding Agent Adoption in OSS
Xu · 2026 - W059 — AI-Generated Smells: An Analysis of Code and Architecture in LLM- and Agent-Driven Development
Zhu · 2026 - W060 — Your AI, My Shell: Demystifying Prompt Injection Attacks on Agentic AI Coding Editors
Liu · 2025 - W061 — 2025 GenAI Code Security Report
Veracode · 2025 - W062 — Vibe Security Radar
Zhao · 2026 - W063 — An Endless Stream of AI Slop: How Developers Discuss the Burden of AI-Assisted Software Development
Baltes · 2026 - W067 — (Don't) Trust, but (Don't) Verify: Developers' Attention to Security in AI-Generated Code
Khalid · 2026 - W077 — Evaluating and Mitigating the Misguidance Effect of Buggy Code in LLM-Generated Unit Tests
Zhao · 2026 - W104 — Coding with Enemy: Can Human Developers Detect AI Agent Sabotage?
Ye · 2026 - W149 — Making AI Visible, Not Vanished: How AI Policies Reshape Developer Experience on GitHub
Chen · 2026 - W150 — We Permit the Use of AI, but [...]: The Landscape of AI Policies in Popular Open Source Projects
Hora · 2026 - W161 — Examining ownership models in software teams: A systematic literature review and a replication study
Koana · 2024 - W164 — Program Comprehension and Code Complexity Metrics: An fMRI Study
Peitek · 2021 - W174 — Impact of Developer Turnover on Quality in Open-Source Software
Foucault · 2015 - W175 — Code Ownership and Software Quality: A Replication Study
Greiler · 2015 - W182 — Don't Touch My Code! Examining the Effects of Ownership on Software Quality
Bird · 2011
Addy Osmani 9
- O004 — Audit your Agent files
Addy Osmani · 2026-08-27 - O007 — Agentic Code Quality
Addy Osmani · 2026-08-08 - O014 — The Agent Stack Bet
Addy Osmani · 2026-04-18 - O028 — Vibe coding is not the same as AI-Assisted engineering.
Addy Osmani · 2025-08-30 - O037 — Vibe Coding is not an excuse for low-quality work
Addy Osmani · 2025-04-18 - O039 — Vibe Coding: Revolution or Reckless Abandon?
Addy Osmani · 2025-04-03 - O040 — MCP: What It Is and Why It Matters
Addy Osmani · 2025-03-27 - O049 — The 70% problem: Hard truths about AI-assisted coding
Addy Osmani · 2024-12-04 - O051 — Agentic Verification
Addy Osmani · 2026-10-14
The Pragmatic Engineer 19
- P002 — Did Automattic commit open source theft?
Gergely Orosz · 2024-10-18 - P006 — How to debug large, distributed systems: Antithesis
Gergely Orosz; Elin Nilsson · 2024-11-12 - P015 — Bug management that works (Part 2)
Gergely Orosz; Elin Nilsson · 2025-01-07 - P017 — Cross-platform mobile development
Gergely Orosz; Elin Nilsson; Fatos Morina · 2025-01-14 - P051 — Why reliability is hard at scale: learnings from infrastructure outages
Gergely Orosz · 2025-07-22 - P053 — Building great SDKs
Gergely Orosz; Quentin Pradet · 2025-07-29 - P066 — What is good software architecture?
Gergely Orosz; Matthew Hawthorne · 2025-10-21 - P067 — What caused the large AWS outage?
Gergely Orosz · 2025-10-23 - P077 — Building MCP servers in the real world
Gergely Orosz; Elin Nilsson · 2025-12-09 - P079 — How AWS deals with a major outage
Gergely Orosz · 2025-12-16 - P082 — The Product-Minded Engineer: The importance of good errors and warnings
Gergely Orosz (interview/introduction); Drew Hoskins (excerpt) · 2026-01-20 - P091 — Are AI agents actually slowing us down?
Gergely Orosz · 2026-03-17 - P097 — How will AI change operating systems? Part 1: Ubuntu and Linux
Gergely Orosz · 2026-04-28 - P101 — AI’s impact on software engineers in 2026: key trends, Part 2
Gergely Orosz; Elin Nilsson · 2026-05-19 - P105 — Why is Meta destroying its engineering organization?
Gergely Orosz · 2026-06-16 - P106 — Reliability fail: No automated zone failover for Coinbase’s global trading service
Gergely Orosz · 2026-06-23 - P107 — Slow down to speed up: so much has changed in 6 months’ time
Gergely Orosz · 2026-06-23 - P113 — Software engineering at a proprietary trading company: Optiver
Gergely Orosz; Ivan Klaric; Jesse Spevack · 2026-08-11 - P120 — How will AI change operating systems? Part 2: Windows
Gergely Orosz; Ivan Klaric · 2026-09-22
Martin Fowler’s website 13
- F002 — Median - A tale in three functions
Birgitta Böckeler · 2023-07-27 - F004 — In-line assistance - how can it get in the way?
Birgitta Böckeler · 2023-08-03 - F010 — Building an AI agent application to migrate a tech stack
Birgitta Böckeler · 2024-08-20 - F011 — Expanding the solution size with multi-file editing
Birgitta Böckeler · 2024-11-19 - F013 — The role of developer skills in agentic coding
Birgitta Böckeler · 2025-03-25 - F014 — Guiding an LLM for Robust Java ByteBuffer Code
Unmesh Joshi · 2025-04-17 - F016 — Coding Assistants Threaten the Software Supply Chain
Jim Gumbley; Lilly Ryan · 2025-05-13 - F017 — Building Custom Tooling with LLMs
Unmesh Joshi · 2025-05-14 - F019 — I still care about the code
Birgitta Böckeler · 2025-07-09 - F022 — Anchoring AI to a reference application
Birgitta Böckeler · 2025-09-25 - F024 — Assessing internal quality while coding with an agent
Erik Doernenburg · 2026-01-27 - F026 — Harness Engineering - first thoughts
Birgitta Böckeler · 2026-02-17 - F030 — The Economic Benefit of Refactoring
Giles Edwards-Alexander · 2026-07-30
Earlier Non-Deterministic books 39
- B004 — The Fundamental Shift
Enrico Papalini · - B008 — The Quality Crisis (And How to Prevent It)
Enrico Papalini · - B013 — PART I: Core Practices
Enrico Papalini · - B014 — PART II: Quality Assurance
Enrico Papalini · - B018 — Antipatterns: What Not to Do
Enrico Papalini · - B023 — Dynamic Context Engineering: Real-Time Information
Enrico Papalini · - B026 — Development Practices Enhanced by AI
Enrico Papalini · - B028 — Security, Compliance \& Governance
Enrico Papalini · - B030 — Common Pitfalls to Avoid
Enrico Papalini · - B032 — Quick Reference Guides
Enrico Papalini · - B034 — Implementation Guide and Solutions
Enrico Papalini · - B035 — AI Adoption in the European Union
Enrico Papalini · - B039 — The Process
Enrico Papalini · - B045 — Complete Implementation Examples
Enrico Papalini · - B050 — The Process: Four Phases, Four Gates
Enrico Papalini · - B057 — The Comparison: Patterns, Divergences, and Convergences
Enrico Papalini · - B059 — Constitution and Architecture: The Framework Foundation
Enrico Papalini · - B060 — The Agent Pipeline and Gates
Enrico Papalini · - B061 — Automation and Extensibility: CLI, Modules, and MCP
Enrico Papalini · - B063 — Advanced Patterns: From Frameworks to Practice
Enrico Papalini · - B066 — Installation and Setup
Enrico Papalini · - B072 — OpenSpec (openspec.dev)
Enrico Papalini · - B076 — Spec Loop Engine
Enrico Papalini · - B081 — AIDD
Enrico Papalini · - B085 — The Continuous Development Revolution
Enrico Papalini · - B086 — The Philosophy of Deterministic Failure
Enrico Papalini · - B088 — The Ralph Loop Pattern
Enrico Papalini · - B089 — Task Decomposition for Machines
Enrico Papalini · - B091 — Quality Gates and Backpressure
Enrico Papalini · - B093 — Agentic Patterns in Practice
Enrico Papalini · - B095 — Multi-Agent Orchestration
Enrico Papalini · - B096 — Safety, Security, and Risk Management
Enrico Papalini · - B097 — Complete Implementation Guide
Enrico Papalini · - B100 — Ralph Loops with VS Code and GitHub Copilot
Enrico Papalini · - B105 — The Organization Becomes a Loop
Enrico Papalini · - B107 — The Ralph Loop: Persistent Progress Through Fresh Context
Enrico Papalini · - B108 — Building a Full Local AI Loop
Enrico Papalini · - B109 — Choosing the Right Loop
Enrico Papalini · - B111 — Glossary
Enrico Papalini ·
Software Engineering Practices 16
- PAT:002 — Swarm Migration (Map-Reduce for Agents)
- PAT:017 — Blast Radius Containment
- PAT:018 — PII and Secret Scrubbing
- PAT:030 — Connectors and Tools: Move Exact Work Outside the Weights
- PAT:034 — Safety and Guardrails: Verification Is Not Authorization
- PAT:036 — CI Sweeper: classify before fixing
- PAT:037 — Dependency Sweeper: route by risk
- PAT:040 — Post-merge cleanup
- PAT:049 — Runtime-in-the-Loop
- PAT:051 — Security-First Development
- PAT:054 — Migration as Learning
- PAT:058 — Acceptable Use Policy
- PAT:063 — Parallel Implementation Exploration
- PAT:077 — Security Pipeline
- PAT:078 — Prompt Injection Scanning
- PAT:079 — Supply-Chain Risk Audit