A few repeat contributors hold open-source cybersecurity ecosystems together

A study of open-source cybersecurity software has found that the work connecting separate developer communities rests on a remarkably small group of people. Researchers reconstructed the full contributor–repository network of 464 cybersecurity-focused projects and 11,372 contributor identities active between October 2001 and May 2022, seeded from the curated Rawsec Cybersecurity Inventory. The corpus closes just before large-language-model coding assistants entered mainstream use, making the measurements a pre-AI baseline for a system now changing fast.

Using Louvain community detection, the team identified 163 non-singleton communities within the bipartite graph. Per-community contributor counts scaled superlinearly with repository count, following a relationship of roughly contributors proportional to repositories raised to the power 1.4, and community formation followed a logistic trajectory whose inflection point fell in 2018. Against this structural backdrop, the analysis asked a specific question: who actually performs work that crosses community boundaries, and what determines whether that work succeeds.

The answer is a thin carrier layer. Only nine contributors spanned seven or more communities at the commit level, yet they authored 14 percent of the 4,015 inter-community merged pull-request records. The top 50 cross-community contributors produced 54 percent of such records, and half of all cross-boundary work came from just 36 contributors, or 0.34 percent of the population. Aggregate activity metrics, the authors note, would not reveal this dependency.

Boundary friction, meanwhile, turned out to be relationship-specific rather than a fixed property of the boundary itself. Under repository and author fixed effects, prior write access in the destination repository raised the odds of a cross-community pull request being merged 2.3-fold and cut integration latency by 66 percent. By contrast, the breadth of a contributor’s activity across other communities bought nothing. What matters is established standing in the destination, not a wide footprint elsewhere.

Community survival was also cohort-structured. The per-cohort residualisation hazard rose by an order of magnitude between the pre-2010 and 2018 cohorts, and a community’s external reach predicted survival mainly through its effect on community size, leaving late-cohort communities under-served. The joint implication, the authors argue, is sharp: the cross-boundary work holding this ecosystem together is carried by very few people and priced by relationships that take years to accumulate, a dependency that could erode without any aggregate metric moving.

The authors are careful about scope. Whether these patterns generalise beyond one curated cybersecurity corpus is untested; the pre-AI baseline they establish is what makes that test possible.

Subject of Research: Cross-community collaboration and contributor relationships in an open-source cybersecurity software ecosystem

Article Title: Building digital societies as ecosystems: how recognition and repeat relationships sustain cross-community work in open source

Article References: Gomez Tejeiro, L., Chataing, T., Jang-Jaccard, J., Mermoud, A., & Maillart, T. (2026). Building digital societies as ecosystems: how recognition and repeat relationships sustain cross-community work in open source. EPJ Data Science. https://doi.org/10.1140/epjds/s13688-026-00701-x

Image Credits: AI Generated

DOI: 10.1140/epjds/s13688-026-00701-x

Keywords: open source, cybersecurity software, collaboration networks, community detection, pull requests, contributor recognition, social networks, software ecosystems, pre-AI baseline, Building, digital, societies