Replication Package for the paper "Who Said CVE? How Vulnerability Identifiers Are Mentioned by Humans, Bots, and Agents in Pull Requests"

Replication Package for "Who Said CVE? How Vulnerabilities Are Mentioned in Human and Agent Authored Pull Requests" This package contains the data files used to conduct our study. Package Structure The replication workflow consists of two main stages: extraction from the AIDev dataset and augmentation via the GitHub API. To better understand our study, we briefly describe the structure of our package: 1. The script `scan_aidev_mentions.py` downloads the AIDev dataset and scans pull requests, commits and reviews for vulnerability patterns (e.g., CVE, CWE, GHSA). The output `aidev_vuln_mentions.csv` contains the raw mentions found in the dataset. 2. The script `augment_mentions.py` queries the GitHub API to find additional mentions in the same repositories as in the AIDev-pop dataset, but searches for different pull requests. The output `augmented_mentions.csv` contains data with actor types (human, bot and agent). 3. The Jupyter Notebook `data_analysis.ipynb` loads the csv output files from the previous steps to compute statistics and generate the figures used in the paper.