2026· International Journal of Advanced Computer Science and Applications· 0 citations· 25 references
TL;DR
It is shown that the enhanced Zynerator framework reduces development effort, strengthens security posture, and accelerates DevSecOps adoption, indicating that DevSecOps-aware model-driven engineering offers a viable pathway toward secure, auto-mated software delivery.
Abstract
We propose an extension to Zynerator, a Model-Driven Architecture framework for automated microservice generation, that embeds DevSecOps principles directly at the modeling stage through semantic decorators. These decorators enable the automated synthesis of secure back-end and front-end components together with operational artifacts, including authentication and authorization modules, audit trails, monitoring dashboards, and DevSecOps pipelines covering SAST, DAST, testing, and deployment. The approach addresses a key limitation of the original Zynerator framework, namely the absence of explicit DevSecOps integration, and supports a security-by-design methodology that reduces reliance on specialized DevSecOps expertise. Through a detailed e-commerce case study and empirical evaluation against manual development and existing Model-Driven Architecture tools, we show that the enhanced framework reduces development effort, strengthens security posture, and accelerates DevSecOps adoption. These findings indicate that DevSecOps-aware model-driven engineering offers a viable pathway toward secure, auto-mated software delivery.
This research proposes the evaluation of a “proxy” DevSecOps pipeline, defined as an automated intermediary architecture that decouples intensive security scanning from the primary build flow to prevent bottlenecks and demonstrates that security validation is the most time-intensive part of the automated proxy workflow.
Abderrahim Rida, A. Bakhil, Ayoub Ait Lahcen· Future Internet· 0 citations
Microservice-based systems evolve continuously through API changes, service splits and merges, dependency churn, and deployment-topology drift driven by DevOps practices. This rapid evolution erodes the assumptions encoded in formal models, test suites, and architectural descriptions, leaving practitioners with limited guidance on how to keep verification artifacts aligned with evolving implementations. Prior surveys cover microservices design, deployment, performance, and isolated verification techniques, but, to our knowledge, none consolidate the intersection of evolution and formal/rigorous verification, nor map how repository-derived signals and CI/CD pipelines support continuous verification of microservice-based systems. This paper addresses that gap through a systematic literature review (SLR). Following the Kitchenham et al. guidelines and PRISMA-style reporting, we defined a review protocol with four research questions covering (i) formal modeling and verification approaches, (ii) the impact of architectural and API evolution on verifiability, (iii) repository-derived signals for updating formal artifacts, and (iv) continuous and incremental verification in CI/CD pipelines. Structured searches in IEEE Xplore, ACM Digital Library, SpringerLink, and Scopus returned 1187 records, which were screened in seven stages and reduced to 18 included studies (13 primary studies that supply evidence and five background studies retained for transparency and framing) through inclusion/exclusion criteria and a weighted 15-item quality-assessment instrument. We synthesized the included studies thematically and compared them along five dimensions: verification technique, evolution dimension, automation level, empirical evidence, and tool/artifact availability. The synthesis shows that actor-based model checking, TLA+ control-plane verification, static code analysis, continuous certification, and runtime/self-adaptive testing form five complementary clusters, but empirical evaluation is dominated by small academic case studies, only a minority of approaches automate model updates from repository signals, and few are integrated end-to-end into CI/CD. We discuss methodological limitations of the body of work, including a lack of industrial-scale validation and shared datasets, contrast intrinsic (build-time, model-driven) and extrinsic (recovery-based) verification strategies, and outline a research agenda toward repository-aware, pipeline-integrated verification for evolving microservices. The present synthesis distils a set of immediate, evidence-based actions for practitioners together with a focused agenda of open research challenges.
R. Gómez, Ebeid Elsayed, Enrique R. Zarate et al.· Software· 0 citations
Continuous Integration and Continuous Deployment (CI/CD) pipelines have become fundamental to modern software engineering, enabling rapid and reliable delivery of applications. However, their automation introduces critical vulnerabilities, particularly credential leaks and misconfigurations, which undermine the security of development and deployment environments. This study investigates security risks in Dock-er-based GitHub Actions workflows and proposes a tailored, DevSecOps-aligned security checklist to mitigate these threats. A systematic literature review was combined with hands-on experiments, in which controlled credential exposures and workflow misconfigurations were deliberately introduced and analyzed. Security controls such as secret scanning with GitGuardian and TruffleHog, configuration validation with GHAST, and access control enforcement were tested in a CI/CD testbed. The findings demonstrate that these integrated methods significantly reduce the risk of credential leakage and pipeline hijacking, while maintaining minimal performance overhead. The novelty of this work lies in consolidating fragmented best practices into a work-flow-specific model that is immediately applicable to real-world projects. This contrib-utes actionable guidance for secure-by-design CI/CD pipelines, offering practical protection against supply-chain threats while preserving delivery speed and scalability.
A. Amirova· International Journal of Wir...· 0 citations
The Adaptive Risk-Driven DevSecOps Framework (ARDDSF) is proposed, a layered framework for securing multi-cloud enterprise systems in the era of agentic artificial intelligence that bridges DevSecOps automation, AI-assisted security analysis, Zero Trust policy enforcement, and multi-cloud governance.
Nitin Bodade· International Journal of Inn...· 0 citations
Pull-request-based development (PBD) is the dominant workflow in modern open-source software (OSS), where pull requests (PRs) are the central coordination unit for review, CI/CD validation, and fixing security vulnerabilities. Existing research studies PR responsiveness, CI/CD performance, and vulnerability handling in isolation, even though delays and security risks accumulate through the same PR-mediated workflow. To address this gap, this thesis treats PBD as a unified workflow and investigates how suboptimal PR management creates avoidable PR delays and increased security risk. We provide empirical evidence and tools to address these coupled outcomes. Overall, the thesis connects efficiency and security through one PR-based workflow. It provides actionable guidance for reducing PR delays by characterizing and improving key efficiency bottlenecks, and offers recommendations for improving vulnerability management by developing an LLM-based, low-noise, evidence-driven security alert system.
Kazi Amit Hasan· SIGSOFT FSE Companion· 0 citations
SaaSGenAI is an AI-driven framework for generating and deploying Software-as-a-Service (SaaS) applications from natural language requirements. Developing SaaS applications traditionally requires significant programming expertise, manual configuration, and considerable development time, making it challenging for startups, entrepreneurs, and nontechnical users to transform ideas into functional software products. Recent advances in artificial intelligence have enabled greater automation in software development; however, many existing solutions focus primarily on individual tasks such as code generation, interface design, or prototyping. SaaSGenAI addresses this limitation by integrating requirement analysis, intelligent blueprint generation, automated code generation, database configuration, authentication setup, and cloud deployment into a single workflow. The framework converts user requirements into structured blueprints that define application features, database schemas, authentication requirements, and user interface components. These blueprints are then used to automatically generate and deploy full-stack web applications with minimal human intervention. By combining artificial intelligence with low-code/no-code development principles, SaaSGenAI reduces development effort, accelerates application delivery, and simplifies the overall software development process. The framework can be effectively applied to rapid prototyping, minimum viable product (MVP) development, internal business applications, content management systems, and other SaaS-based solutions, demonstrating the practical potential of AI-assisted software engineering.
S. Uke, Samruddhi Walunjkar, S. Ukirade et al.· 2026 6th International Confe...· 0 citations