Exploratory Evaluation of Secure Design Methodologies Between Security and Code Quality - Alexi, Arthur; Ribas, Yghor; Bastos, Hugo; Brito, Aline; Cardoso, Leonardo; Tavares, Cleiton (Anais do Simpósio Brasileiro de Qualidade de Software (SBQS); 2025: Anais do XXIV Simpósio Brasileiro de Qualidade de SoftwareDO - 10.5753/sbqs.2025.15086, 2025)
This paper investigates the impacts of secure design methodologies on the structural quality and presence of vulnerabilities in systems developed in Java. We analyzed 333 popular GitHub repositories, classified according to four security approaches: Security by Design, Defense in Depth, Runtime Security and Zero Trust Architecture. Using static analysis techniques, we evaluated vulnerabilities based on the CWE taxonomy, in addition to code quality metrics such as coupling (CBO), cohesion (LCOM) and cyclomatic complexity. The results indicate that the adoption of secure design practices, although relevant for risk mitigation, can negatively impact the modularity of the system. In particular, approaches such as Security by Design presented higher levels of coupling and lower cohesion. We also observed that the combination of multiple security practices did not necessarily result in a lower number of vulnerabilities, suggesting an increase in complexity without proportional benefit. These findings highlight the importance of balanced architectural decisions that consider the commitments between security and internal software quality.