Software vulnerabilities are a significant concern, posing high costs and risks to developers and users. While previous work has focused on automated detection and vulnerability datasets, a deeper understanding of the human element in the fixing process is needed. Our research aims to characterize how developers address software vulnerabilities in the Android project. We conducted an empirical study using vulnerability-fixing commits from the Big-Vul dataset to analyze fix complexity, developer experience, and the delay in public disclosure. Our findings indicate that vulnerability fixes are typically small, affecting fewer lines of code and files compared to regular commits. Furthermore, our results suggest that the authors of these fixes are predominantly experienced in the codebase, though contributions from inexperienced developers also occur. Finally, we observe a considerable delay between a vulnerability fix being published and its corresponding CVE being publicly updated. These conclusions contribute to a better understanding of vulnerability remediation and can assist developers in assigning responsibilities and estimating fix times.
BARROS et al. (2026) studied this question.