Proactively recording and maintaining security feature locations

Develop techniques that record and maintain security features and their implementation locations during development with little additional developer effort, while determining appropriate feature and code-location granularities.

Background

Proactive recording could preserve security knowledge at the time a feature is introduced or modified and could provide context to later developers and coding agents. However, the paper identifies unresolved questions about how to capture this information with minimal effort, what levels of granularity to record, and how to keep recorded locations consistent as the implementation evolves.

References

But how can security features be recorded with little additional developer effort, and at what levels of granularity in the security feature hierarchy (e.g., cryptography, encryption, AES) and in the code structure (e.g., statements, lines, functions, classes, namespaces)?

— The Security Feature Location Problem  (2609.04899 - Hermann et al., 4 Sep 2026) in Section 5, Research Challenges, subsection “C2.2: How can we proactively record and maintain security feature locations?”

But what level of granularity provides the best balance for a given security task, and how does this affect the overhead and benefits of security feature location?

— The Security Feature Location Problem  (2609.04899 - Hermann et al., 4 Sep 2026) in Section 5, Research Challenges, subsection “C3.3: What level of granularity provides the best trade-off for different security tasks?”