How Security Coding Knowledge Impact Software Quality: An Empirical Study of Stack Overflow Security Issues

Stack Overflow has become one of the most influential platforms for developers to share knowledge and exchange practical coding solutions. With millions of reusable code snippets contributed by users worldwide, it plays a vital role in modern software development. However, the collaborative and informal nature of the platform may inadvertently promote insecure coding practices, particularly when contributors lack adequate secure coding knowledge. These practices can introduce security weaknesses into software systems, posing serious risks when such code is reused in production environments. This paper empirically investigates the prevalence of Common Weakness Enumeration (CWE) instances in C# code snippets on Stack Overflow and analyzes how such security-relevant code evolves through user revisions. We further examine the extent to which Stack Overflow users are aware of and apply the Microsoft C# Secure Coding Guidelines. The results of our study show that: (1) Users repeatedly post code snippets containing the same security weaknesses. Notably, 40.2% of the latest versions of such answers were marked as “accepted” by the original askers.(2) Revisions to code containing these weaknesses are more likely to deteriorate, whereas users with greater C# experience are more likely to reduce them.(3) More than half of the survey respondents indicated that they were not aware of the Microsoft C# Secure Coding Guidelines. The top three approaches they expected to use for addressing security issues were: marking them as insecure, fixing the issues themselves, and seeking help from the Stack Overflow community.