An Empirical Study on Security Misconfigurations in TypeScript Backends in the Open Source Academic Projects
Resumo
Security misconfigurations represent a persistent threat to modern web systems. Considering the rise of TypeScript-based backend systems in academic applications, there is still a lack of guidelines ensuring that these security measures are taken into account, even though the theory is usually well-documented in the frameworks’ official documentation. This work proposes an empirical study of open-source academic projects to identify vulnerabilities in TypeScript systems. The methodology combines mining software repositories (MSR) and static code analysis. The tool VulnSniffer was developed to automate data extraction from the selected repositories. A total of 164 repositories linked to academic projects were selected for analysis. To identify the vulnerabilities, this work conducted three studies. First, VulnSniffer automatically identifies vulnerabilities; then, the tool allows the author to manually audit each detected vulnerability to determine the automated tool’s accuracy; finally, a questionnaire was administered to a cybersecurity expert to analyze the quality of both the automated analysis and the manual audit. Our results show that 72 repositories exhibited at least one vulnerability identified automatically by the tool. After a manual audit, 45 repositories were confirmed to have at least one vulnerability
Palavras-chave:
Mining Software Repository, Security Misconfigurations, Source COde Analysis, TypeScript, Web Vulnerabilities
Referências
Sultan S. Alqahtani, Ellis E. Eghan, and Juergen Rilling. 2016. Tracing known security vulnerabilities in software repositories: A Semantic Web enabled modeling approach. Science of Computer Programming 121 (2016), 153–175.
Amazon Web Services. 2025. What is a Web Application? Disponível em: [link].
Constanze Dietrich, Katharina Krombholz, Kevin Borgolte, and Tobias Fiebig. 2018. Investigating System Operators’ Perspective on Security Misconfigurations. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS ’18). 18. DOI: 10.1145/3243734.3243794
Sarah J. Dow-Fleisner, Cherisse L. Seaton, Eric Li, Katrina Plamondon, Nelly Oelke, Donna Kurtz, Charlotte Jones, Leanne M. Currie, Barb Pesut, Khalad Hasan, and Kathy L. Rush. 2022. Internet access is a necessity: a latent class analysis of COVID-19 related challenges and the role of technology use among rural community residents. BMC Public Health 22, 1 (27 Apr 2022), 845. DOI: 10.1186/s12889-022-13254-1
Matus Formanek and Martin Zaborsky. 2017. Web Interface Security Vulnerabilities of Selected European Open-access Academic Repositories. LIBER Quarterly 27, 1 (2017), 45–57.
Mahmudul Hasan, Farhana Zaman Rozony, Md Kamruzzaman, and Md Kazi Shahab Uddin. 2024. Common Cybersecurity Vulnerabilities: Software Bugs, Weak Passwords, Misconfigurations, Social Engineering. Global Mainstream Journal of Innovation, Engineering & Emerging Technology 03, 04 (august 2024), 42–57. DOI: 10.62304/jieet.v3i4.193
International Organization for Standardization. 2018. ISO/IEC 27000:2018 Information technology – Security techniques – Information security management systems – Overview and vocabulary. Standard. ISO/IEC.
V. Benjamin Livshits and Monica S. Lam. 2005. Finding Security Vulnerabilities in Java Applications with Static Analysis. In Proceedings of the 14th USENIX Security Symposium. USENIX Association, 271–286.
OWASP Foundation. 2025. OWASP Top 10:2025. [link].
J. S. Rauthan and K. S. Vaisla. 2017. Privacy and Security of User’s Sensitive Data: A Viable Analysis. In Proceedings of the Second International Conference on Research in Intelligent and Computing in Engineering (ACSIS, Vol. 10). 67–71. DOI: 10.15439/2017R45
Felipe Ferreira Sampaio. 2021. Uma análise prática das principais vulnerabilidades em aplicações web baseado no top 10 OWASP. Trabalho de Conclusão de Curso, Graduação em Redes de Computadores, Universidade Federal do Ceará.
State of Javascript/Typescript. 2025. Back-end Frameworks Ratios Over Time. Disponível em: [link].
M. Syarifudin, Lilik Widyawati, and Ondi Asroni. 2025. Web Security Vulnerability Analysis and Mitigation Based on OWASP TOP 10. Journal of Artificial Intelligence and Engineering Applications 4, 3 (june 2025), 1830–1834.
TCM Security. 2025. OWASP Top 10 Predications for 2025. Disponível em: [link].
Amazon Web Services. 2025. What is a Web Application? Disponível em: [link].
Constanze Dietrich, Katharina Krombholz, Kevin Borgolte, and Tobias Fiebig. 2018. Investigating System Operators’ Perspective on Security Misconfigurations. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS ’18). 18. DOI: 10.1145/3243734.3243794
Sarah J. Dow-Fleisner, Cherisse L. Seaton, Eric Li, Katrina Plamondon, Nelly Oelke, Donna Kurtz, Charlotte Jones, Leanne M. Currie, Barb Pesut, Khalad Hasan, and Kathy L. Rush. 2022. Internet access is a necessity: a latent class analysis of COVID-19 related challenges and the role of technology use among rural community residents. BMC Public Health 22, 1 (27 Apr 2022), 845. DOI: 10.1186/s12889-022-13254-1
Matus Formanek and Martin Zaborsky. 2017. Web Interface Security Vulnerabilities of Selected European Open-access Academic Repositories. LIBER Quarterly 27, 1 (2017), 45–57.
Mahmudul Hasan, Farhana Zaman Rozony, Md Kamruzzaman, and Md Kazi Shahab Uddin. 2024. Common Cybersecurity Vulnerabilities: Software Bugs, Weak Passwords, Misconfigurations, Social Engineering. Global Mainstream Journal of Innovation, Engineering & Emerging Technology 03, 04 (august 2024), 42–57. DOI: 10.62304/jieet.v3i4.193
International Organization for Standardization. 2018. ISO/IEC 27000:2018 Information technology – Security techniques – Information security management systems – Overview and vocabulary. Standard. ISO/IEC.
V. Benjamin Livshits and Monica S. Lam. 2005. Finding Security Vulnerabilities in Java Applications with Static Analysis. In Proceedings of the 14th USENIX Security Symposium. USENIX Association, 271–286.
OWASP Foundation. 2025. OWASP Top 10:2025. [link].
J. S. Rauthan and K. S. Vaisla. 2017. Privacy and Security of User’s Sensitive Data: A Viable Analysis. In Proceedings of the Second International Conference on Research in Intelligent and Computing in Engineering (ACSIS, Vol. 10). 67–71. DOI: 10.15439/2017R45
Felipe Ferreira Sampaio. 2021. Uma análise prática das principais vulnerabilidades em aplicações web baseado no top 10 OWASP. Trabalho de Conclusão de Curso, Graduação em Redes de Computadores, Universidade Federal do Ceará.
State of Javascript/Typescript. 2025. Back-end Frameworks Ratios Over Time. Disponível em: [link].
M. Syarifudin, Lilik Widyawati, and Ondi Asroni. 2025. Web Security Vulnerability Analysis and Mitigation Based on OWASP TOP 10. Journal of Artificial Intelligence and Engineering Applications 4, 3 (june 2025), 1830–1834.
TCM Security. 2025. OWASP Top 10 Predications for 2025. Disponível em: [link].
Publicado
11/09/2026
Como Citar
BRAGA, Leandro; FRANCISCO, Phyllipe; BATISTA, Bruno.
An Empirical Study on Security Misconfigurations in TypeScript Backends in the Open Source Academic Projects. In: WORKSHOP DE VISUALIZAÇÃO, EVOLUÇÃO E MANUTENÇÃO DE SOFTWARE (VEM), 14. , 2026, São Paulo/SP.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 7-13.
DOI: https://doi.org/10.5753/vem.2026.31989.
