Replication package for: Code Health Metrics and Security Vulnerabilities: An Empirical Study Across Programming Language Ecosystems

Replication package for the article "Code Health Metrics and Security Vulnerabilities: An Empirical Study Across Programming Language Ecosystems", submitted to a journal. This package contains the dataset and the analysis notebook for an observational mining software repositories study of whether code smells and code health are associated with security vulnerabilities in open-source software. Two static analysis tools were run over the same set of GitHub repositories: Semgrep v1.170.0, which produces security findings mapped to CWE and OWASP categories, and CodeScene 7.5.2, which produces Code Health scores (1–10) and code-smell instances. The study covers seven languages: C, C#, C++, Go, Java, JavaScript and Python. Study population 1,303 open-source GitHub repositories, 169 to 195 per language, selected by stars (minimum 50; no forks, archived, tutorial or documentation-only repositories) 1,291,460 analysed source files (1,042,223 with a CodeHealth score), 288.8 million lines of code 17,530 vulnerability findings in 730 projects across 175 CWE identifiers (Semgrep security category, HIGH confidence, with a CWE or OWASP label) 4,417,747 code-smell instances across 22 CodeScene smell categories Research questions RQ1: How strongly is CodeHealth (CH) associated with security vulnerability findings, and to what extent does that association persist when file size is controlled? RQ2: To what extent do these associations generalise across programming language ecosystems? RQ3: Which code smells, and which classes of vulnerability, account for any association that survives size control? Contents Vulnerabilities_vs_CodeSmells_Analysis.ipynb: Jupyter notebook containing the complete analysis pipeline (data loading, normalisation, filtering, descriptive statistics, contingency and Mantel–Haenszel analyses, negative-binomial and mixed-effects models, correlation analyses, line-level permutation tests, Code Health analysis, sensitivity analyses). Section 0.1 of the notebook maps every table and figure in the article to the cell that produces it. accepted_projects.csv: one row per candidate repository (name, primary language, GitHub URL, description, stars). semgrep_results.csv: one row per Semgrep finding (file path, line range, rule, severity, confidence, CWE, OWASP). codescene_results.csv: one row per file (LOC, Code Health, language, hotspot, change frequency, defects, knowledge loss, author fragmentation, modification age). codescene_details.csv: one row per smell instance (file × function × smell category, line range). requirements.txt: pinned Python dependencies. README.md: instructions for reproducing the results. How to reproduce Install Python 3.14 and the dependencies: pip install -r requirements.txt (main libraries: pandas 3.0.5, numpy 2.5.2, scipy 1.18.0, statsmodels 0.14.6, matplotlib, seaborn, scikit-learn, matplotlib-venn). Extract the data archive into the same folder as the notebook. Open the notebook and run all cells from top to bottom in a fresh kernel. All stochastic procedures use a fixed seed (42), with 2,000 bootstrap and 2,000 permutation replicates. The inputs total about 2.2 GB uncompressed. A machine with at least 16 GB RAM is recommended. Full runtime is approximately [X hours]. Tool versions and scan details Semgrep v1.170.0 & CodeScene 7.5.2, analysing each repository against its full Git history. Repositories were selected via the GitHub REST API and scanned between 01.07.2026 and 05.07.2026. Notes Semgrep findings are rule matches, not confirmed vulnerabilities. The data contains file paths, line numbers and tool metadata only. No source code from the analysed repositories is redistributed. Funding This work was partially supported by the Knowledge Foundation, Sweden (SESAM project, grant number 20140218). Citation If you use this dataset, please cite the article: Selimovic, M., Borg, M., Fucci, D., and Abd Almisreb, A., Code Health Metrics and Security Vulnerabilities: An Empirical Study Across Programming Language Ecosystems. Under submission, 2026.