The security Gap: 96% of IoT Repositories on GitHub Ignore Critical Security Concerns

This dataset contains the metadata and analysis results of a large-scale mining study of open-source Internet of Things (IoT) software repositories hosted on GitHub. The dataset includes repositories identified using IoT- and security-related keywords extracted from repository metadata (topics, descriptions, and README files), along with classifications based on security properties, attack types, vulnerabilities, and repository activity metrics. The data were collected to facilitate transparency, replication, and future research on IoT security practices in open-source software. The step-by-step analysis method: 1. Define scope & goals Time window: 2008-01-01 to 2025-10-15. Target: open-source IoT projects that mention security (properties, attacks, vulnerabilities). Outputs: CSV with metadata + activity metrics + derived fields (commit nature, last commit, etc.). 2. Build keyword lists (70 total) Create two groups: IoT terms (e.g., IoT, internet of things, smart home, smart grid, healthcare, IIoT, abbreviations, spaced/concise variants) and security terms (e.g., authentication, availability, DoS, vulnerability, encryption, attack names). Include variants and abbreviations (e.g., smarthome, "smart home", IIoT, Industrial IoT) and common misspellings (e.g., Reply, Replay). Search logic: union (OR) within each group, then require at least one IoT term AND at least one security term (intersection). Example GitHub query format: 'Smart Retail Vulnerability', 'SmartRetail Vulnerability', 'Smart Retail Vulnerable', 'SmartRetail Vulnerable 3. Authenticate & prepare tooling Create a GitHub Personal Access Token. Use Python packages: PyGithub. 4. Search in reasonably sized time chunks Split the whole period into intervals (e.g., yearly or shorter) to avoid search result caps and reduce rate-limit problems. 5. Extract per-repo fields For each repository retrieved, collect and store: full_name, html_url, description, topics (repo.get_topics()), language(s) (repo.get_languages()), size, created_atActivity metrics: stargazers_count, forks_count Commits: repo.get_commits().totalCount (set 0 on errors or empty repo) Contributors: repo.get_contributors().totalCount (handle permission exceptions) Last commit date: repo.get_commits()[0].commit.author.date (handle empty) Releases/downloads: sum assets’ download_count from repo.get_releases() (set 0 if none) Pull requests: use repo.get_pulls(state='all').totalCount (or GraphQL for faster totals) Save each repo row to CSV; deduplicate by full_name (use a set()). 6. Cleaning & deduplication Remove duplicates (same full_name), and discard repos with size == 0 Keep language normalization (lowercase, consistent names). 7. Manual validation / quality check Randomly sample a subset, have two raters classify whether each repo truly fits “IoT + security”. Remove non-English repositories. 8. Activity filtering Compute summary statistics (mean) for each activity metric (commits, PRs, forks, stars, contributors, last commit recency). We used a threshold = mean (repositories with metric > mean are “active” for that metric). 9. Temporal and categorical analyses Aggregate counts per year (temporal evolution), per application domain (smart home, healthcare, IIoT,...), and per security property/attack. 10. Export & record Store final CSV(s): metadata + metrics + derived fields (Commits, Contributors, Forks, Stars, LastCommit, Commits_Nature, Total_Downloads, Creation_Date, etc.).