  Context: Security is vital to software developed for commercial or personal
use. Although more organizations are realizing the importance of applying
secure coding practices, in many of them, security concerns are not known or
addressed until a security failure occurs. The root cause of security failures
is vulnerable code. While metrics have been used to predict software
vulnerabilities, we explore the relationship between code and architectural
smells with security weaknesses. As smells are surface indicators of a deeper
problem in software, determining the relationship between smells and software
vulnerabilities can play a significant role in vulnerability prediction models.
Objective: This study explores the relationship between smells and software
vulnerabilities to identify the smells. Method: We extracted the class, method,
file, and package level smells for three systems: Apache Tomcat, Apache CXF,
and Android. We then compared their occurrences in the vulnerable classes which
were reported to contain vulnerable code and in the neutral classes
(non-vulnerable classes where no vulnerability had yet been reported). Results:
We found that a vulnerable class is more likely to have certain smells compared
to a non-vulnerable class. God Class, Complex Class, Large Class, Data Class,
Feature Envy, Brain Class have a statistically significant relationship with
software vulnerabilities. We found no significant relationship between
architectural smells and software vulnerabilities. Conclusion: We can conclude
that for all the systems examined, there is a statistically significant
correlation between software vulnerabilities and some smells.
