Predicting Vulnerable Code Changes Using Technical Debt Indicators

Technical debt refers to the cost of delayed technical work and poor design choices in software systems. Software security focuses on protecting systems against vulnerabilities and exploits. In this study, we explore the relationship between technical debt and software vulnerabilities to understand how technical debt impacts software security. We collected real world data from six software projects, including code changes and corresponding vulnerabilities. We investigate various technical debt indicators, such as code smells, bugs, and software metrics, along with technical debt mitigation methods like refactoring activities, to predict vulnerabilities. The findings reveal a significant association between technical debt and vulnerabilities, highlighting the impact of technical debt on software security. We also identify specific artifacts, such as code smells, that contribute to the emergence of vulnerabilities. By understanding this relationship, software practitioners and project managers can gain insights into the risks associated with accumulated technical debt and take appropriate measures to enhance software security and quality.