Original title: Security smell detection in Dockerfiles
Wenbo Zhang, Inah Omoronyia · September 2026
Dockerfiles contain instructions for setting up software environments, but developers often make mistakes that cause security smells—hidden weaknesses like leaked secrets or improper permissions. Older scanner tools miss many of these weaknesses because they rely on rigid text rules that fail to understand complex code. To fix this, researchers built an AI-based system. It works by using a specially trained language model to spot multiple risks across ten categories. Then, it uses a helper module to write out clear explanations and generate corrected code. They packed the system into a VSCode tool that runs in real time. The new tool beat older scanners by finding 9–28 percentage points more risks, while helping developers understand and fix security problems much faster.
Imagine proofreading a recipe for a dinner party. You check the ingredient list once and assume it is fine. But some mistakes only show up when steps interact, like adding salt twice because the sauce and the marinade each assume the other is unsalted. A spell-checker misses those, and only a cook who reads the whole method can explain what went wrong. In this paper, the recipe is a setup file that describes how to build a software service, the spell-checker is the old checking tool, and the new system reads the whole method, spots the interacting mistakes, and writes out the corrected version.
Developers who write Dockerfiles get security problems caught while they code, not after a container is deployed. The system explains what is wrong and shows corrected code, so fixing a misconfiguration takes less effort and fewer mistakes reach production.
The abstract doesn't state explicit limitations. It reports results on a curated test set and a user study, but not on real-world deployment at scale, and it does not compare against other LLM-based approaches. The ten categories and 4,000 annotated files bound the scope, so smells outside those categories are not covered.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
Security smell detection in Dockerfiles — Wenbo Zhang, Inah Omoronyia — Automated Software Engineering — doi:10.1007/s10515-026-00684-z
Abstract licence: CC BY
Explanation generated by Synthesis from the abstract — it is not the original paper.