Security Drift

SecurityDriftLab-Auto is an open-source research framework for evaluating the security implications of AI-assisted software development through longitudinal analysis of iterative prompt evolution. The framework implements the Security Drift Analytics Framework (SDAF), a methodology for quantifying how software security changes across successive prompt refinements generated by large language models (LLMs).

Unlike conventional one-shot evaluations that assess individual AI-generated programs, SecurityDriftLab-Auto models software security as a dynamic property of developer–AI interaction. The framework introduces four complementary metrics: Security Drift Index (SDI), Severity-Weighted Security Drift (SW-SDI), Security Regression Rate (SRR), and Vulnerability Churn (VC). Together, these metrics enable quantitative analysis of vulnerability evolution throughout iterative AI-assisted software development.

The framework provides an end-to-end automated experimental pipeline that includes benchmark execution, iterative prompt generation, AI-assisted code generation, static vulnerability analysis using Bandit and Semgrep, CWE-based vulnerability normalization, Security Drift computation, statistical analysis (including Kruskal–Wallis tests, Dunn's post-hoc comparisons, and bootstrap confidence intervals), and publication-ready tables and figures.

SecurityDriftLab-Auto is model-agnostic and extensible, supporting evaluation across multiple programming languages, large language models, cybersecurity benchmark categories, and static analysis tools. The repository is intended to facilitate reproducible research in AI-assisted software engineering, secure code generation, prompt engineering, and software security evaluation.

This artifact accompanies the manuscript:

Security Drift in AI-Assisted Software Development: A Framework for Measuring the Security Impact of Iterative Prompt Evolution

and contains the complete implementation, datasets, experimental configurations, analysis scripts, and visualization utilities required to reproduce the reported results.

Keywords: AI-assisted software development, large language models, secure code generation, software security, prompt engineering, Security Drift, static analysis, vulnerability detection, empirical software engineering, reproducible research.