Yueqi Chen
University of Colorado Boulder, CO·Computer Science
Forecasts of hurricanes, floods, droughts and wildfires often come from large open-source simulation programs. One of the most important is the Community Earth System Model (CESM).
- Fields
Computer Science
Earth & Environmental Science
- Topics
software security
open-source software
Community Earth System Model
- Grants
- 1 known grant, through Sep 2027
What they work on
- Refactor the Community Earth System Model (CESM) codebase by decoupling its computational and control logic and rewriting the control layer in Python, so that modern security practices can be integrated.
- Build static analysis tools that find vulnerabilities without running the code, combining a query engine, compile-time testing and large language models tailored to CESM's code structure.
- Develop dynamic testing for CESM scientific workflows using targeted unit and regression tests, and supply-chain techniques that detect and mitigate risks from vulnerable software dependencies.
- Integrate these security checks into an upgraded continuous integration and delivery (CI/CD) pipeline, and support it with maintainer vetting and hands-on secure-coding training for developers.
More about the research
Decisions about disaster response, agriculture, energy, public health and defense rely on its output, so hidden weaknesses in its code, or in the outside software packages it depends on, could be exploited through backdoors or cyber attacks. This project asks how to bring modern security practice to a large, older scientific code base.
Why it matters
Agencies and planners who rely on CESM projections for disaster response, farming, energy planning, public health and national defense need software that cannot be quietly tampered with. A more secure, better-tested CESM could reduce that risk. The framework is intended to serve as a model for hardening other widely used scientific codes, so many research communities could also benefit.
Known grants
From NIH and NSF research grants. Labs often have other funding we can't see.
Closest labs
Xing Gao
University of Delaware, DE·Computer Science·Early-career
Build a security testing system that combines dynamic execution and static analysis to examine every critical component of continuous software development pipelines and how each interacts with the people and organizations involved.
Alexandros Kapravelos
North Carolina State University, NC·Computer Science·Early-career
Define the security properties that continuous integration workflows should satisfy and design a Workflow Intermediate Representation, a common format that workflows from any CI platform can be translated into for uniform analysis.
Justin Cappos
New York University, NY·Computer Science
Build a command-line framework that automatically records software artifacts, environments, dependencies and actions during experiments, so computational studies can be rebuilt and rerun in the cloud for independent verification.
The school
University of Colorado Boulder: 36 labs on PI Pages, $718M a year on research, 447 research doctorates a year.
Reach out
A start for your email. Fill in the brackets.