Quantify the effect of expertise connectivity on cross-owner remediation capacity

Quantify robustly how cross-owner expertise connectivity affects the feasibility of reallocating vulnerability-remediation capacity under ownership constraints and incomplete assignee histories.

Background

The paper models resolver overlap as a proxy for whether one owner can borrow remediation capacity from another owner with relevant expertise. The estimated effect differs substantially between Apache and Mozilla, but assignee information is missing for a large proportion of issues: 26.5% in Apache and 47.1% in Mozilla.

Because missing assignee histories may be systematic, the observed resolver-connectivity networks may not accurately represent the underlying expertise relationships. Consequently, the paper leaves unresolved the robust quantification of how expertise connectivity contributes to the mobilization of otherwise inaccessible remediation capacity.

References

The contribution of expertise connectivity cannot be quantified precisely in the present data because assignee information is available for only 73.5% of Apache issues and 52.9% of Mozilla issues, and the missingness may be systematic. More complete assignee histories are therefore required to estimate this effect robustly.

— Rethinking Vulnerability Remediation as a Capacity Allocation Problem  (2608.28509 - Stucke, 28 Aug 2026) in Section 4.4, subsection “Expertise-eligible borrowing”