{
  "study": "How big is an authorization fix? Patch size by weakness family in the GitHub Advisory Database",
  "publisher": "Stingrai",
  "license": "CC BY 4.0",
  "corpus": "GitHub Advisory Database, reviewed advisories only",
  "corpus_snapshot_date": "2026-07-28",
  "generated_at": "2026-07-28T08:33:19.673Z",
  "script": "analyze.mjs",
  "families": {
    "access_control": {
      "label": "Access control",
      "cwes": [
        "CWE-284",
        "CWE-285",
        "CWE-639",
        "CWE-732",
        "CWE-862",
        "CWE-863"
      ],
      "note": "Improper access control, improper authorization, authorization bypass through user controlled key (IDOR), incorrect permission assignment, missing authorization, incorrect authorization."
    },
    "injection": {
      "label": "Injection",
      "cwes": [
        "CWE-77",
        "CWE-78",
        "CWE-89",
        "CWE-94"
      ],
      "note": "Command injection, OS command injection, SQL injection, code injection. CWE-79 is deliberately NOT in this set."
    },
    "xss": {
      "label": "Cross site scripting",
      "cwes": [
        "CWE-79"
      ],
      "note": "Split out separately. XSS is formally an injection weakness but its fixes are dominated by output encoding and template escaping, a different repair shape from query or command construction."
    }
  },
  "inclusion_rules": [
    "Advisory type is 'reviewed' in the GitHub Advisory Database.",
    "The advisory CWE list intersects exactly one of the three families. Advisories touching two or more families are dropped as ambiguous.",
    "The advisory references exactly one distinct GitHub commit URL. Pull request, compare and advisory URLs are not counted as commit references. Short and full SHAs of the same commit are collapsed."
  ],
  "exclusion_rules": {
    "order": [
      "commit_unresolvable",
      "merge_commit",
      "no_line_changes",
      "non_code_only",
      "size_outlier"
    ],
    "outlier_line_threshold": 1000,
    "non_code_patterns": [
      "/(^|\\/)(tests?|spec|specs|__tests__|testing|test_data|testdata|fixtures?|e2e|integration_tests)\\//i",
      "/(^|\\/)test_[^/]*$/i",
      "/[._-](test|spec)\\.[A-Za-z0-9]+$/i",
      "/[._-](Test|Tests|Spec)\\.[A-Za-z0-9]+$/",
      "/(^|\\/)(docs?|documentation|website|examples?|samples?|man)\\//i",
      "/\\.(md|markdown|rst|txt|adoc|asciidoc|pod)$/i",
      "/(^|\\/)(CHANGELOG|CHANGES|HISTORY|NEWS|LICENSE|LICENCE|COPYING|NOTICE|AUTHORS|CONTRIBUTORS)([.-][^/]*)?$/i",
      "/(^|\\/)(package-lock\\.json|npm-shrinkwrap\\.json|yarn\\.lock|pnpm-lock\\.yaml|composer\\.lock|Gemfile\\.lock|poetry\\.lock|Pipfile\\.lock|Cargo\\.lock|go\\.sum|mix\\.lock|packages\\.lock\\.json)$/i",
      "/\\.lock$/i",
      "/(^|\\/)(vendor|vendors|node_modules|third_party|thirdparty|dist|build|out|target|_build)\\//i",
      "/\\.min\\.(js|css)$/i",
      "/\\.map$/i",
      "/(^|\\/)(\\.github|\\.circleci|\\.gitlab)\\//i",
      "/(^|\\/)(SECURITY|README)([.-][^/]*)?$/i"
    ]
  },
  "census": {
    "total_advisories": 10809,
    "dropped_multi_family": 97,
    "dropped_zero_commits": 5210,
    "dropped_multi_commit": 1052
  },
  "exclusions": {
    "commit_unresolvable": 28,
    "merge_commit": 391,
    "no_line_changes": 1,
    "non_code_only": 79,
    "size_outlier": 145
  },
  "measured_advisories": 3806,
  "pooled": {
    "access_control": {
      "changed_lines": {
        "n": 1100,
        "min": 1,
        "q1": 19,
        "median": 64,
        "q3": 173.25,
        "iqr": 154.25,
        "p90": 380.1,
        "max": 951,
        "mean": 134.02
      },
      "changed_files": {
        "n": 1100,
        "min": 1,
        "q1": 2,
        "median": 3,
        "q3": 5,
        "iqr": 3,
        "p90": 9,
        "max": 70,
        "mean": 4.36
      },
      "code_changed_lines": {
        "n": 1100,
        "min": 1,
        "q1": 9,
        "median": 25,
        "q3": 68,
        "iqr": 59,
        "p90": 156,
        "max": 860,
        "mean": 61.43
      },
      "repos": 491
    },
    "injection": {
      "changed_lines": {
        "n": 948,
        "min": 1,
        "q1": 13,
        "median": 39,
        "q3": 116.25,
        "iqr": 103.25,
        "p90": 260.6,
        "max": 997,
        "mean": 100.33
      },
      "changed_files": {
        "n": 948,
        "min": 1,
        "q1": 1,
        "median": 2,
        "q3": 4,
        "iqr": 3,
        "p90": 8,
        "max": 300,
        "mean": 4.18
      },
      "code_changed_lines": {
        "n": 948,
        "min": 0,
        "q1": 8,
        "median": 23,
        "q3": 61.25,
        "iqr": 53.25,
        "p90": 150.6,
        "max": 958,
        "mean": 59.85
      },
      "repos": 562
    },
    "xss": {
      "changed_lines": {
        "n": 1758,
        "min": 1,
        "q1": 6,
        "median": 19,
        "q3": 64.75,
        "iqr": 58.75,
        "p90": 174,
        "max": 986,
        "mean": 65.54
      },
      "changed_files": {
        "n": 1758,
        "min": 1,
        "q1": 1,
        "median": 2,
        "q3": 4,
        "iqr": 3,
        "p90": 8,
        "max": 87,
        "mean": 3.78
      },
      "code_changed_lines": {
        "n": 1758,
        "min": 1,
        "q1": 4,
        "median": 11,
        "q3": 32.75,
        "iqr": 28.75,
        "p90": 87.3,
        "max": 959,
        "mean": 36.07
      },
      "repos": 754
    }
  },
  "pooled_tests": {
    "access_control_vs_injection": {
      "mann_whitney_changed_lines": {
        "u": 596166,
        "z": 5.6,
        "p_two_sided": 2.107e-8,
        "rank_biserial": 0.14
      },
      "median_diff_changed_lines": 25,
      "bootstrap_ci_median_diff": {
        "lo": 16,
        "hi": 34
      }
    },
    "access_control_vs_xss": {
      "mann_whitney_changed_lines": {
        "u": 1302862.5,
        "z": 15.66,
        "p_two_sided": 0,
        "rank_biserial": 0.35
      },
      "median_diff_changed_lines": 45
    }
  },
  "repository_matched": {
    "n_repositories": 90,
    "n_advisories": 791,
    "pooled_within_matched_repositories": {
      "access_control": {
        "changed_lines": {
          "n": 469,
          "min": 1,
          "q1": 23,
          "median": 68,
          "q3": 154,
          "iqr": 131,
          "p90": 338.2,
          "max": 951,
          "mean": 126.33
        },
        "changed_files": {
          "n": 469,
          "min": 1,
          "q1": 2,
          "median": 3,
          "q3": 5,
          "iqr": 3,
          "p90": 8,
          "max": 38,
          "mean": 4.09
        },
        "code_changed_lines": {
          "n": 469,
          "min": 1,
          "q1": 9,
          "median": 27,
          "q3": 66,
          "iqr": 57,
          "p90": 131,
          "max": 577,
          "mean": 54.16
        }
      },
      "injection": {
        "changed_lines": {
          "n": 322,
          "min": 1,
          "q1": 13,
          "median": 49.5,
          "q3": 131.5,
          "iqr": 118.5,
          "p90": 263.9,
          "max": 960,
          "mean": 103.05
        },
        "changed_files": {
          "n": 322,
          "min": 1,
          "q1": 1,
          "median": 3,
          "q3": 5,
          "iqr": 4,
          "p90": 9,
          "max": 43,
          "mean": 4.04
        },
        "code_changed_lines": {
          "n": 322,
          "min": 1,
          "q1": 9,
          "median": 26,
          "q3": 66.25,
          "iqr": 57.25,
          "p90": 154.8,
          "max": 958,
          "mean": 62.48
        }
      }
    },
    "paired_by_repository": {
      "changed_lines": {
        "median_of_per_repository_differences": 0,
        "q1": -65,
        "q3": 40.5,
        "sign_test": {
          "n": 87,
          "pos": 44,
          "neg": 43,
          "ties": 3,
          "p_two_sided": 1
        }
      },
      "changed_files": {
        "median_of_per_repository_differences": 0,
        "sign_test": {
          "n": 74,
          "pos": 35,
          "neg": 39,
          "ties": 16,
          "p_two_sided": 0.7275
        }
      },
      "mann_whitney_changed_lines": {
        "u": 84091.5,
        "z": 2.72,
        "p_two_sided": 0.006555,
        "rank_biserial": 0.11
      },
      "bootstrap_ci_median_diff": {
        "lo": 6,
        "hi": 33
      },
      "code_changed_lines": {
        "median_of_per_repository_differences": -3.5,
        "sign_test": {
          "n": 86,
          "pos": 36,
          "neg": 50,
          "ties": 4,
          "p_two_sided": 0.1606
        }
      },
      "mann_whitney_code_changed_lines": {
        "u": 75598,
        "z": 0.03,
        "p_two_sided": 0.9775,
        "rank_biserial": 0
      }
    },
    "per_repository": [
      {
        "repo": "openclaw/openclaw",
        "n_access_control": 135,
        "n_injection": 38,
        "median_access_control_lines": 146,
        "median_injection_lines": 157,
        "diff_lines": -11,
        "diff_files": -1.5
      },
      {
        "repo": "xwiki/xwiki-platform",
        "n_access_control": 27,
        "n_injection": 22,
        "median_access_control_lines": 72,
        "median_injection_lines": 71.5,
        "diff_lines": 0.5,
        "diff_files": -1
      },
      {
        "repo": "moodle/moodle",
        "n_access_control": 28,
        "n_injection": 14,
        "median_access_control_lines": 28,
        "median_injection_lines": 21,
        "diff_lines": 7,
        "diff_files": 0.5
      },
      {
        "repo": "wwbn/avideo",
        "n_access_control": 20,
        "n_injection": 18,
        "median_access_control_lines": 21,
        "median_injection_lines": 15.5,
        "diff_lines": 5.5,
        "diff_files": -0.5
      },
      {
        "repo": "dolibarr/dolibarr",
        "n_access_control": 7,
        "n_injection": 23,
        "median_access_control_lines": 51,
        "median_injection_lines": 63,
        "diff_lines": -12,
        "diff_files": -1
      },
      {
        "repo": "pimcore/pimcore",
        "n_access_control": 3,
        "n_injection": 22,
        "median_access_control_lines": 45,
        "median_injection_lines": 11,
        "diff_lines": 34,
        "diff_files": 1
      },
      {
        "repo": "craftcms/cms",
        "n_access_control": 15,
        "n_injection": 9,
        "median_access_control_lines": 9,
        "median_injection_lines": 9,
        "diff_lines": 0,
        "diff_files": 0
      },
      {
        "repo": "go-gitea/gitea",
        "n_access_control": 16,
        "n_injection": 1,
        "median_access_control_lines": 111.5,
        "median_injection_lines": 20,
        "diff_lines": 91.5,
        "diff_files": 1
      },
      {
        "repo": "jenkinsci/jenkins",
        "n_access_control": 15,
        "n_injection": 1,
        "median_access_control_lines": 78,
        "median_injection_lines": 8,
        "diff_lines": 70,
        "diff_files": -1
      },
      {
        "repo": "gogs/gogs",
        "n_access_control": 12,
        "n_injection": 3,
        "median_access_control_lines": 14,
        "median_injection_lines": 34,
        "diff_lines": -20,
        "diff_files": -1
      },
      {
        "repo": "thorsten/phpmyfaq",
        "n_access_control": 7,
        "n_injection": 6,
        "median_access_control_lines": 23,
        "median_injection_lines": 9,
        "diff_lines": 14,
        "diff_files": 1.5
      },
      {
        "repo": "mantisbt/mantisbt",
        "n_access_control": 10,
        "n_injection": 2,
        "median_access_control_lines": 6.5,
        "median_injection_lines": 27.5,
        "diff_lines": -21,
        "diff_files": 0
      },
      {
        "repo": "froxlor/froxlor",
        "n_access_control": 6,
        "n_injection": 6,
        "median_access_control_lines": 11.5,
        "median_injection_lines": 32.5,
        "diff_lines": -21,
        "diff_files": -1
      },
      {
        "repo": "rails/rails",
        "n_access_control": 3,
        "n_injection": 9,
        "median_access_control_lines": 28,
        "median_injection_lines": 26,
        "diff_lines": 2,
        "diff_files": 0
      },
      {
        "repo": "filebrowser/filebrowser",
        "n_access_control": 9,
        "n_injection": 2,
        "median_access_control_lines": 7,
        "median_injection_lines": 51,
        "diff_lines": -44,
        "diff_files": -3
      },
      {
        "repo": "symfony/symfony",
        "n_access_control": 5,
        "n_injection": 6,
        "median_access_control_lines": 33,
        "median_injection_lines": 83,
        "diff_lines": -50,
        "diff_files": -2
      },
      {
        "repo": "librenms/librenms",
        "n_access_control": 3,
        "n_injection": 8,
        "median_access_control_lines": 54,
        "median_injection_lines": 9,
        "diff_lines": 45,
        "diff_files": 0.5
      },
      {
        "repo": "mlflow/mlflow",
        "n_access_control": 5,
        "n_injection": 4,
        "median_access_control_lines": 96,
        "median_injection_lines": 62,
        "diff_lines": 34,
        "diff_files": -0.5
      },
      {
        "repo": "pgadmin-org/pgadmin4",
        "n_access_control": 1,
        "n_injection": 8,
        "median_access_control_lines": 12,
        "median_injection_lines": 82.5,
        "diff_lines": -70.5,
        "diff_files": -1.5
      },
      {
        "repo": "pyload/pyload",
        "n_access_control": 3,
        "n_injection": 5,
        "median_access_control_lines": 49,
        "median_injection_lines": 10,
        "diff_lines": 39,
        "diff_files": 0
      },
      {
        "repo": "microweber/microweber",
        "n_access_control": 4,
        "n_injection": 4,
        "median_access_control_lines": 10,
        "median_injection_lines": 8,
        "diff_lines": 2,
        "diff_files": 0
      },
      {
        "repo": "liferay/liferay-portal",
        "n_access_control": 6,
        "n_injection": 2,
        "median_access_control_lines": 30,
        "median_injection_lines": 19,
        "diff_lines": 11,
        "diff_files": -1
      },
      {
        "repo": "yeswiki/yeswiki",
        "n_access_control": 2,
        "n_injection": 6,
        "median_access_control_lines": 40,
        "median_injection_lines": 11,
        "diff_lines": 29,
        "diff_files": 1
      },
      {
        "repo": "openbao/openbao",
        "n_access_control": 5,
        "n_injection": 2,
        "median_access_control_lines": 93,
        "median_injection_lines": 155,
        "diff_lines": -62,
        "diff_files": -1
      },
      {
        "repo": "getgrav/grav",
        "n_access_control": 1,
        "n_injection": 6,
        "median_access_control_lines": 557,
        "median_injection_lines": 33,
        "diff_lines": 524,
        "diff_files": 6
      },
      {
        "repo": "grafana/grafana",
        "n_access_control": 5,
        "n_injection": 1,
        "median_access_control_lines": 37,
        "median_injection_lines": 15,
        "diff_lines": 22,
        "diff_files": 1
      },
      {
        "repo": "langflow-ai/langflow",
        "n_access_control": 3,
        "n_injection": 3,
        "median_access_control_lines": 220,
        "median_injection_lines": 87,
        "diff_lines": 133,
        "diff_files": 1
      },
      {
        "repo": "apache/airflow",
        "n_access_control": 3,
        "n_injection": 3,
        "median_access_control_lines": 91,
        "median_injection_lines": 35,
        "diff_lines": 56,
        "diff_files": 4
      },
      {
        "repo": "nilsteampassnet/teampass",
        "n_access_control": 4,
        "n_injection": 2,
        "median_access_control_lines": 95,
        "median_injection_lines": 77,
        "diff_lines": 18,
        "diff_files": -0.5
      },
      {
        "repo": "shopware/platform",
        "n_access_control": 4,
        "n_injection": 2,
        "median_access_control_lines": 210,
        "median_injection_lines": 198.5,
        "diff_lines": 11.5,
        "diff_files": -1.5
      },
      {
        "repo": "admidio/admidio",
        "n_access_control": 4,
        "n_injection": 1,
        "median_access_control_lines": 13.5,
        "median_injection_lines": 224,
        "diff_lines": -210.5,
        "diff_files": -2
      },
      {
        "repo": "alextselegidis/easyappointments",
        "n_access_control": 3,
        "n_injection": 2,
        "median_access_control_lines": 34,
        "median_injection_lines": 66,
        "diff_lines": -32,
        "diff_files": -9.5
      },
      {
        "repo": "publify/publify",
        "n_access_control": 4,
        "n_injection": 1,
        "median_access_control_lines": 32,
        "median_injection_lines": 29,
        "diff_lines": 3,
        "diff_files": 1
      },
      {
        "repo": "spring-projects/spring-framework",
        "n_access_control": 3,
        "n_injection": 2,
        "median_access_control_lines": 160,
        "median_injection_lines": 35,
        "diff_lines": 125,
        "diff_files": 4
      },
      {
        "repo": "apache/nifi",
        "n_access_control": 3,
        "n_injection": 2,
        "median_access_control_lines": 16,
        "median_injection_lines": 156,
        "diff_lines": -140,
        "diff_files": -9
      },
      {
        "repo": "jenkinsci/script-security-plugin",
        "n_access_control": 3,
        "n_injection": 2,
        "median_access_control_lines": 121,
        "median_injection_lines": 40.5,
        "diff_lines": 80.5,
        "diff_files": 3
      },
      {
        "repo": "olivetin/olivetin",
        "n_access_control": 3,
        "n_injection": 1,
        "median_access_control_lines": 126,
        "median_injection_lines": 241,
        "diff_lines": -115,
        "diff_files": -5
      },
      {
        "repo": "n8n-io/n8n",
        "n_access_control": 2,
        "n_injection": 2,
        "median_access_control_lines": 125,
        "median_injection_lines": 497,
        "diff_lines": -372,
        "diff_files": -4.5
      },
      {
        "repo": "honojs/hono",
        "n_access_control": 3,
        "n_injection": 1,
        "median_access_control_lines": 197,
        "median_injection_lines": 73,
        "diff_lines": 124,
        "diff_files": 0
      },
      {
        "repo": "pimcore/admin-ui-classic-bundle",
        "n_access_control": 2,
        "n_injection": 2,
        "median_access_control_lines": 5,
        "median_injection_lines": 16.5,
        "diff_lines": -11.5,
        "diff_files": 0
      },
      {
        "repo": "oneuptime/oneuptime",
        "n_access_control": 3,
        "n_injection": 1,
        "median_access_control_lines": 59,
        "median_injection_lines": 54,
        "diff_lines": 5,
        "diff_files": 1
      },
      {
        "repo": "pimcore/customer-data-framework",
        "n_access_control": 3,
        "n_injection": 1,
        "median_access_control_lines": 9,
        "median_injection_lines": 11,
        "diff_lines": -2,
        "diff_files": 0
      },
      {
        "repo": "francoisjacquet/rosariosis",
        "n_access_control": 2,
        "n_injection": 2,
        "median_access_control_lines": 27.5,
        "median_injection_lines": 34.5,
        "diff_lines": -7,
        "diff_files": -3
      },
      {
        "repo": "budibase/budibase",
        "n_access_control": 2,
        "n_injection": 2,
        "median_access_control_lines": 45,
        "median_injection_lines": 254,
        "diff_lines": -209,
        "diff_files": -3.5
      },
      {
        "repo": "django/django",
        "n_access_control": 1,
        "n_injection": 3,
        "median_access_control_lines": 52,
        "median_injection_lines": 132,
        "diff_lines": -80,
        "diff_files": -5
      },
      {
        "repo": "casdoor/casdoor",
        "n_access_control": 3,
        "n_injection": 1,
        "median_access_control_lines": 50,
        "median_injection_lines": 90,
        "diff_lines": -40,
        "diff_files": -13
      },
      {
        "repo": "apache/superset",
        "n_access_control": 2,
        "n_injection": 2,
        "median_access_control_lines": 124,
        "median_injection_lines": 79,
        "diff_lines": 45,
        "diff_files": -1
      },
      {
        "repo": "berriai/litellm",
        "n_access_control": 1,
        "n_injection": 3,
        "median_access_control_lines": 38,
        "median_injection_lines": 104,
        "diff_lines": -66,
        "diff_files": 1
      },
      {
        "repo": "openremote/openremote",
        "n_access_control": 3,
        "n_injection": 1,
        "median_access_control_lines": 143,
        "median_injection_lines": 226,
        "diff_lines": -83,
        "diff_files": 0
      },
      {
        "repo": "apache/inlong",
        "n_access_control": 1,
        "n_injection": 3,
        "median_access_control_lines": 24,
        "median_injection_lines": 4,
        "diff_lines": 20,
        "diff_files": 1
      },
      {
        "repo": "azuracast/azuracast",
        "n_access_control": 3,
        "n_injection": 1,
        "median_access_control_lines": 14,
        "median_injection_lines": 31,
        "diff_lines": -17,
        "diff_files": 0
      },
      {
        "repo": "octobercms/october",
        "n_access_control": 2,
        "n_injection": 2,
        "median_access_control_lines": 34.5,
        "median_injection_lines": 16,
        "diff_lines": 18.5,
        "diff_files": 0
      },
      {
        "repo": "denoland/deno",
        "n_access_control": 2,
        "n_injection": 2,
        "median_access_control_lines": 203.5,
        "median_injection_lines": 120,
        "diff_lines": 83.5,
        "diff_files": 17.5
      },
      {
        "repo": "navidrome/navidrome",
        "n_access_control": 1,
        "n_injection": 3,
        "median_access_control_lines": 113,
        "median_injection_lines": 29,
        "diff_lines": 84,
        "diff_files": 1
      },
      {
        "repo": "openrefine/openrefine",
        "n_access_control": 1,
        "n_injection": 3,
        "median_access_control_lines": 19,
        "median_injection_lines": 74,
        "diff_lines": -55,
        "diff_files": -4
      },
      {
        "repo": "projectdiscovery/nuclei",
        "n_access_control": 1,
        "n_injection": 2,
        "median_access_control_lines": 251,
        "median_injection_lines": 98,
        "diff_lines": 153,
        "diff_files": 5
      },
      {
        "repo": "pterodactyl/panel",
        "n_access_control": 2,
        "n_injection": 1,
        "median_access_control_lines": 353.5,
        "median_injection_lines": 35,
        "diff_lines": 318.5,
        "diff_files": 10.5
      },
      {
        "repo": "contao/contao",
        "n_access_control": 2,
        "n_injection": 1,
        "median_access_control_lines": 132,
        "median_injection_lines": 7,
        "diff_lines": 125,
        "diff_files": 5.5
      },
      {
        "repo": "apache/struts",
        "n_access_control": 1,
        "n_injection": 2,
        "median_access_control_lines": 154,
        "median_injection_lines": 59,
        "diff_lines": 95,
        "diff_files": 0
      },
      {
        "repo": "apache/hive",
        "n_access_control": 1,
        "n_injection": 2,
        "median_access_control_lines": 10,
        "median_injection_lines": 84,
        "diff_lines": -74,
        "diff_files": -2
      },
      {
        "repo": "forgekeep/nebula-mesh",
        "n_access_control": 2,
        "n_injection": 1,
        "median_access_control_lines": 145,
        "median_injection_lines": 557,
        "diff_lines": -412,
        "diff_files": 3
      },
      {
        "repo": "argoproj/argo-workflows",
        "n_access_control": 2,
        "n_injection": 1,
        "median_access_control_lines": 128,
        "median_injection_lines": 183,
        "diff_lines": -55,
        "diff_files": 1.5
      },
      {
        "repo": "charmbracelet/soft-serve",
        "n_access_control": 2,
        "n_injection": 1,
        "median_access_control_lines": 41,
        "median_injection_lines": 3,
        "diff_lines": 38,
        "diff_files": 1
      },
      {
        "repo": "ethyca/fides",
        "n_access_control": 2,
        "n_injection": 1,
        "median_access_control_lines": 290,
        "median_injection_lines": 249,
        "diff_lines": 41,
        "diff_files": -6.5
      },
      {
        "repo": "dgtlmoon/changedetection.io",
        "n_access_control": 2,
        "n_injection": 1,
        "median_access_control_lines": 52,
        "median_injection_lines": 130,
        "diff_lines": -78,
        "diff_files": -0.5
      },
      {
        "repo": "imagemagick/imagemagick",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 5,
        "median_injection_lines": 246,
        "diff_lines": -241,
        "diff_files": 0
      },
      {
        "repo": "neuron-core/neuron-ai",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 2,
        "median_injection_lines": 2,
        "diff_lines": 0,
        "diff_files": 0
      },
      {
        "repo": "scitokens/scitokens",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 55,
        "median_injection_lines": 165,
        "diff_lines": -110,
        "diff_files": 0
      },
      {
        "repo": "opensource-workshop/connect-cms",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 96,
        "median_injection_lines": 960,
        "diff_lines": -864,
        "diff_files": -9
      },
      {
        "repo": "saltstack/salt",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 94,
        "median_injection_lines": 207,
        "diff_lines": -113,
        "diff_files": -2
      },
      {
        "repo": "typo3/typo3",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 14,
        "median_injection_lines": 264,
        "diff_lines": -250,
        "diff_files": -3
      },
      {
        "repo": "ezsystems/ezpublish-legacy",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 68,
        "median_injection_lines": 3,
        "diff_lines": 65,
        "diff_files": 1
      },
      {
        "repo": "modoboa/modoboa",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 23,
        "median_injection_lines": 129,
        "diff_lines": -106,
        "diff_files": -6
      },
      {
        "repo": "jenkinsci/workflow-cps-global-lib-plugin",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 109,
        "median_injection_lines": 421,
        "diff_lines": -312,
        "diff_files": -4
      },
      {
        "repo": "phenixdigital/phoenix_storybook",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 77,
        "median_injection_lines": 347,
        "diff_lines": -270,
        "diff_files": -1
      },
      {
        "repo": "bolt/bolt",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 86,
        "median_injection_lines": 160,
        "diff_lines": -74,
        "diff_files": -3
      },
      {
        "repo": "nuclio/nuclio",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 60,
        "median_injection_lines": 260,
        "diff_lines": -200,
        "diff_files": 2
      },
      {
        "repo": "craftcms/commerce",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 5,
        "median_injection_lines": 17,
        "diff_lines": -12,
        "diff_files": -1
      },
      {
        "repo": "devtron-labs/devtron",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 73,
        "median_injection_lines": 86,
        "diff_lines": -13,
        "diff_files": 1
      },
      {
        "repo": "shopware/shopware",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 95,
        "median_injection_lines": 7,
        "diff_lines": 88,
        "diff_files": 6
      },
      {
        "repo": "apache/zeppelin",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 68,
        "median_injection_lines": 38,
        "diff_lines": 30,
        "diff_files": 2
      },
      {
        "repo": "fasterxml/jackson-databind",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 124,
        "median_injection_lines": 8,
        "diff_lines": 116,
        "diff_files": 1
      },
      {
        "repo": "valtimo-platform/valtimo-backend-libraries",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 464,
        "median_injection_lines": 291,
        "diff_lines": 173,
        "diff_files": 9
      },
      {
        "repo": "matrix-org/matrix-rust-sdk",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 99,
        "median_injection_lines": 101,
        "diff_lines": -2,
        "diff_files": 1
      },
      {
        "repo": "dompdf/dompdf",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 2,
        "median_injection_lines": 11,
        "diff_lines": -9,
        "diff_files": -1
      },
      {
        "repo": "gerapy/gerapy",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 96,
        "median_injection_lines": 96,
        "diff_lines": 0,
        "diff_files": 0
      },
      {
        "repo": "stanfordnlp/corenlp",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 22,
        "median_injection_lines": 100,
        "diff_lines": -78,
        "diff_files": -2
      },
      {
        "repo": "apache/lucene-solr",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 44,
        "median_injection_lines": 40,
        "diff_lines": 4,
        "diff_files": 3
      },
      {
        "repo": "apache/hadoop",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 699,
        "median_injection_lines": 48,
        "diff_lines": 651,
        "diff_files": 3
      },
      {
        "repo": "laravel/framework",
        "n_access_control": 1,
        "n_injection": 1,
        "median_access_control_lines": 44,
        "median_injection_lines": 2,
        "diff_lines": 42,
        "diff_files": 1
      }
    ]
  },
  "robustness": {
    "note": "code_changed_lines counts only files that do not match the published non code patterns (tests, docs, lockfiles, vendored and generated output).",
    "code_only_pooled": {
      "access_control": {
        "n": 1100,
        "min": 1,
        "q1": 9,
        "median": 25,
        "q3": 68,
        "iqr": 59,
        "p90": 156,
        "max": 860,
        "mean": 61.43
      },
      "injection": {
        "n": 948,
        "min": 0,
        "q1": 8,
        "median": 23,
        "q3": 61.25,
        "iqr": 53.25,
        "p90": 150.6,
        "max": 958,
        "mean": 59.85
      },
      "xss": {
        "n": 1758,
        "min": 1,
        "q1": 4,
        "median": 11,
        "q3": 32.75,
        "iqr": 28.75,
        "p90": 87.3,
        "max": 959,
        "mean": 36.07
      },
      "access_control_vs_injection": {
        "median_diff": 2,
        "mann_whitney": {
          "u": 542638.5,
          "z": 1.59,
          "p_two_sided": 0.1114,
          "rank_biserial": 0.04
        },
        "bootstrap_ci_median_diff": {
          "lo": -1,
          "hi": 7
        }
      },
      "access_control_vs_xss": {
        "median_diff": 14,
        "mann_whitney": {
          "u": 1231057,
          "z": 12.32,
          "p_two_sided": 0,
          "rank_biserial": 0.27
        }
      }
    },
    "non_code_share_of_changed_lines_pct": {
      "access_control": {
        "n": 1100,
        "min": 0,
        "q1": 0,
        "median": 37.5,
        "q3": 73.6,
        "iqr": 73.6,
        "p90": 87.5,
        "max": 99.1,
        "mean": 37.98
      },
      "injection": {
        "n": 948,
        "min": 0,
        "q1": 0,
        "median": 3.7,
        "q3": 56.15,
        "iqr": 56.15,
        "p90": 77.93,
        "max": 100,
        "mean": 26.76
      },
      "xss": {
        "n": 1758,
        "min": 0,
        "q1": 0,
        "median": 0,
        "q3": 50,
        "iqr": 50,
        "p90": 81.8,
        "max": 99.3,
        "mean": 23.11
      }
    },
    "commits_touching_a_non_code_file": {
      "access_control": {
        "n": 1100,
        "commits_with_at_least_one_non_code_file": 669,
        "share_pct": 60.82
      },
      "injection": {
        "n": 948,
        "commits_with_at_least_one_non_code_file": 488,
        "share_pct": 51.48
      },
      "xss": {
        "n": 1758,
        "commits_with_at_least_one_non_code_file": 729,
        "share_pct": 41.47
      }
    }
  },
  "repository_concentration": {
    "access_control": {
      "n": 1100,
      "distinct_repositories": 491,
      "top_repository": "openclaw/openclaw",
      "top_repository_share_pct": 12.27,
      "top_10": [
        {
          "repo": "openclaw/openclaw",
          "n": 135,
          "share_pct": 12.27
        },
        {
          "repo": "moodle/moodle",
          "n": 28,
          "share_pct": 2.55
        },
        {
          "repo": "xwiki/xwiki-platform",
          "n": 27,
          "share_pct": 2.45
        },
        {
          "repo": "mattermost/mattermost",
          "n": 24,
          "share_pct": 2.18
        },
        {
          "repo": "usememos/memos",
          "n": 22,
          "share_pct": 2
        },
        {
          "repo": "wwbn/avideo",
          "n": 20,
          "share_pct": 1.82
        },
        {
          "repo": "go-gitea/gitea",
          "n": 16,
          "share_pct": 1.45
        },
        {
          "repo": "craftcms/cms",
          "n": 15,
          "share_pct": 1.36
        },
        {
          "repo": "jenkinsci/jenkins",
          "n": 15,
          "share_pct": 1.36
        },
        {
          "repo": "keycloak/keycloak",
          "n": 13,
          "share_pct": 1.18
        }
      ]
    },
    "injection": {
      "n": 948,
      "distinct_repositories": 562,
      "top_repository": "openclaw/openclaw",
      "top_repository_share_pct": 4.01,
      "top_10": [
        {
          "repo": "openclaw/openclaw",
          "n": 38,
          "share_pct": 4.01
        },
        {
          "repo": "dolibarr/dolibarr",
          "n": 23,
          "share_pct": 2.43
        },
        {
          "repo": "pimcore/pimcore",
          "n": 22,
          "share_pct": 2.32
        },
        {
          "repo": "xwiki/xwiki-platform",
          "n": 22,
          "share_pct": 2.32
        },
        {
          "repo": "wwbn/avideo",
          "n": 18,
          "share_pct": 1.9
        },
        {
          "repo": "moodle/moodle",
          "n": 14,
          "share_pct": 1.48
        },
        {
          "repo": "sebhildebrandt/systeminformation",
          "n": 10,
          "share_pct": 1.05
        },
        {
          "repo": "craftcms/cms",
          "n": 9,
          "share_pct": 0.95
        },
        {
          "repo": "rails/rails",
          "n": 9,
          "share_pct": 0.95
        },
        {
          "repo": "pgadmin-org/pgadmin4",
          "n": 8,
          "share_pct": 0.84
        }
      ]
    },
    "xss": {
      "n": 1758,
      "distinct_repositories": 754,
      "top_repository": "pimcore/pimcore",
      "top_repository_share_pct": 3.92,
      "top_10": [
        {
          "repo": "pimcore/pimcore",
          "n": 69,
          "share_pct": 3.92
        },
        {
          "repo": "liferay/liferay-portal",
          "n": 63,
          "share_pct": 3.58
        },
        {
          "repo": "librenms/librenms",
          "n": 57,
          "share_pct": 3.24
        },
        {
          "repo": "thorsten/phpmyfaq",
          "n": 47,
          "share_pct": 2.67
        },
        {
          "repo": "microweber/microweber",
          "n": 41,
          "share_pct": 2.33
        },
        {
          "repo": "jenkinsci/jenkins",
          "n": 34,
          "share_pct": 1.93
        },
        {
          "repo": "xwiki/xwiki-platform",
          "n": 32,
          "share_pct": 1.82
        },
        {
          "repo": "moodle/moodle",
          "n": 30,
          "share_pct": 1.71
        },
        {
          "repo": "mantisbt/mantisbt",
          "n": 26,
          "share_pct": 1.48
        },
        {
          "repo": "craftcms/cms",
          "n": 23,
          "share_pct": 1.31
        }
      ]
    }
  },
  "sensitivity_leave_top_repository_out": {
    "note": "Leave one package out. The largest single contributor to the access control sample is removed from every family, and the pooled comparison is recomputed.",
    "excluded_repository": "openclaw/openclaw",
    "excluded_rows_by_family": {
      "access_control": 135,
      "injection": 38,
      "xss": 2
    },
    "excluded_advisories_by_publish_month_all_families": {
      "2026-02": 18,
      "2026-03": 93,
      "2026-04": 59,
      "2026-05": 5
    },
    "excluded_advisories_by_publish_month_access_control": {
      "2026-02": 9,
      "2026-03": 66,
      "2026-04": 56,
      "2026-05": 4
    },
    "pooled_without_top_repository": {
      "access_control": {
        "changed_lines": {
          "n": 965,
          "min": 1,
          "q1": 15,
          "median": 53,
          "q3": 150,
          "iqr": 135,
          "p90": 338.6,
          "max": 941,
          "mean": 121.08
        },
        "code_changed_lines": {
          "n": 965,
          "min": 1,
          "q1": 8,
          "median": 23,
          "q3": 62,
          "iqr": 54,
          "p90": 142.6,
          "max": 860,
          "mean": 58.95
        }
      },
      "injection": {
        "changed_lines": {
          "n": 910,
          "min": 1,
          "q1": 12,
          "median": 36,
          "q3": 107,
          "iqr": 95,
          "p90": 247.2,
          "max": 997,
          "mean": 96.77
        },
        "code_changed_lines": {
          "n": 910,
          "min": 0,
          "q1": 7,
          "median": 21.5,
          "q3": 58.75,
          "iqr": 51.75,
          "p90": 146.1,
          "max": 958,
          "mean": 58.24
        }
      },
      "xss": {
        "changed_lines": {
          "n": 1756,
          "min": 1,
          "q1": 6,
          "median": 19,
          "q3": 64.25,
          "iqr": 58.25,
          "p90": 174,
          "max": 986,
          "mean": 65.42
        },
        "code_changed_lines": {
          "n": 1756,
          "min": 1,
          "q1": 4,
          "median": 11,
          "q3": 33,
          "iqr": 29,
          "p90": 87.5,
          "max": 959,
          "mean": 36.09
        }
      }
    },
    "access_control_vs_injection_without_top_repository": {
      "median_diff_changed_lines": 17,
      "median_diff_code_changed_lines": 1.5,
      "mann_whitney_changed_lines": {
        "u": 486179,
        "z": 4.02,
        "p_two_sided": 0.00005808,
        "rank_biserial": 0.11
      },
      "mann_whitney_code_changed_lines": {
        "u": 449492.5,
        "z": 0.89,
        "p_two_sided": 0.3738,
        "rank_biserial": 0.02
      },
      "bootstrap_ci_median_diff_changed_lines": {
        "lo": 9.5,
        "hi": 26
      },
      "bootstrap_ci_median_diff_code_changed_lines": {
        "lo": -2,
        "hi": 5
      }
    },
    "paired_by_repository_without_top_repository": {
      "n_repositories": 89,
      "median_of_per_repository_differences": 0,
      "sign_test": {
        "n": 86,
        "pos": 44,
        "neg": 42,
        "ties": 3,
        "p_two_sided": 0.9142
      }
    }
  },
  "descriptive_breakdown": {
    "access_control": {
      "top_ecosystems": [
        [
          "go",
          266
        ],
        [
          "maven",
          239
        ],
        [
          "npm",
          223
        ],
        [
          "composer",
          221
        ],
        [
          "pip",
          103
        ],
        [
          "rubygems",
          18
        ],
        [
          "rust",
          16
        ],
        [
          "nuget",
          8
        ]
      ],
      "severity": {
        "high": 323,
        "critical": 95,
        "medium": 597,
        "low": 85
      }
    },
    "injection": {
      "top_ecosystems": [
        [
          "npm",
          264
        ],
        [
          "composer",
          250
        ],
        [
          "pip",
          167
        ],
        [
          "maven",
          112
        ],
        [
          "go",
          88
        ],
        [
          "rubygems",
          36
        ],
        [
          "rust",
          10
        ],
        [
          "actions",
          10
        ]
      ],
      "severity": {
        "high": 452,
        "critical": 343,
        "medium": 133,
        "low": 20
      }
    },
    "xss": {
      "top_ecosystems": [
        [
          "composer",
          747
        ],
        [
          "maven",
          335
        ],
        [
          "npm",
          284
        ],
        [
          "pip",
          174
        ],
        [
          "go",
          122
        ],
        [
          "rubygems",
          75
        ],
        [
          "nuget",
          12
        ],
        [
          "rust",
          5
        ]
      ],
      "severity": {
        "medium": 1291,
        "low": 111,
        "high": 280,
        "critical": 76
      }
    }
  }
}