PolyPasswordHasher: Improving Password Storage Security. - Santiago Torres-Arias; Justin Cappos (login Usenix Mag., 2014)

Diplomat: Using Delegations to Protect Community Repositories. - Trishank Karthik Kuppusamy; Santiago Torres-Arias; Vladimir Diaz; Justin Cappos (NSDI, 2016)

On Omitting Commits and Committing Omissions: Preventing Git Metadata Tampering That (Re)introduces Software Vulnerabilities. - Santiago Torres-Arias; Anil Kumar Ammula; Reza Curtmola; Justin Cappos (USENIX Security Symposium, 2016)

le-git-imate: Towards Verifiable Web-based Git Repositories. - Hammad Afzali; Santiago Torres-Arias; Reza Curtmola; Justin Cappos (AsiaCCS, 2018)

Commit Signatures for Centralized Version Control Systems. - Sangat Vaidya; Santiago Torres-Arias; Reza Curtmola; Justin Cappos (SEC, 2019)

in-toto: Providing farm-to-table guarantees for bits and bytes. - Santiago Torres-Arias; Hammad Afzali; Trishank Karthik Kuppusamy; Reza Curtmola; Justin Cappos (USENIX Security Symposium, 2019)

Towards adding verifiability to web-based Git repositories. - Hammad Afzali; Santiago Torres-Arias; Reza Curtmola; Justin Cappos (J. Comput. Secur., 2020)

COLBAC: Shifting Cybersecurity from Hierarchical to Horizontal Designs. - Kevin Gallagher 001; Santiago Torres-Arias; Nasir D. Memon; Jessica Feldman (NSPW, 2021)

Sigstore: Software Signing for Everybody. - Zachary Newman; John Speed Meyers; Santiago Torres-Arias (CCS, 2022)

SCORED '22: ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses. - Santiago Torres-Arias; Marcela S. Melara; Laurent Simon (CCS, 2022)

SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties. - Chinenye Okafor; Taylor R. Schorlemmer; Santiago Torres-Arias; James C. Davis 001 (SCORED@CCS, 2022)

Bootstrapping Trust in Community Repository Projects. - Sangat Vaidya; Santiago Torres-Arias; Justin Cappos; Reza Curtmola (SecureComm, 2022)

SCORED '23: Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses. - Marcela S. Melara; Santiago Torres-Arias; Laurent Simon (CCS, 2023)

Speranza: Usable, Privacy-friendly Software Signing. - Kelsey Merrill; Zachary Newman; Santiago Torres-Arias; Karen R. Sollins (CCS, 2023)

Behind the Scenes: Uncovering TLS and Server Certificate Practice of IoT Device Vendors in the Wild. - Hongying Dong; Hao Shu; Vijay Prakash; Yizhe Zhang 006; Muhammad Talha Paracha; David R. Choffnes; Santiago Torres-Arias; Danny Yuxing Huang; Yixin Sun (IMC, 2023)

Preventing Supply Chain Vulnerabilities in Java with a Fine-Grained Permission Manager. - Paschal C. Amusuo; Kyle A. Robinson; Santiago Torres-Arias; Laurent Simon; James C. Davis 001 (CoRR, 2023)

Rust for Embedded Systems: Current State, Challenges and Open Problems. - Ayushi Sharma; Shashank Sharma; Santiago Torres-Arias; Aravind Machiry (CoRR, 2023)

A Viewpoint on Software Supply Chain Security: Are We Getting Lost in Translation? - Marcela S. Melara; Santiago Torres-Arias (IEEE Secur. Priv., 2023)

A Viewpoint on Knowing Software: Bill of Materials Quality When You See It. - Santiago Torres-Arias; Daniel E. Geer; John Speed Meyers (IEEE Secur. Priv., 2023)

Towards verifiable web-based code review systems. - Hammad Afzali; Santiago Torres-Arias; Reza Curtmola; Justin Cappos (J. Comput. Secur., 2023)

Rust for Embedded Systems: Current State and Open Problems. - Ayushi Sharma; Shashank Sharma; Sai Ritvik Tanksalkar; Santiago Torres-Arias; Aravind Machiry (CCS, 2024)

SCORED '24: Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses. - Santiago Torres-Arias; Marcela S. Melara (CCS, 2024)

Should Smart Homes Be Afraid of Evil Maids? : Identifying Vulnerabilities in IoT Device Firmware. - Austen Knapp; Emmanuel Wamuo; Minhajul Alam Rahat; Santiago Torres-Arias; Gedare Bloom; Yanyan Zhuang (CCWC, 2024)

Signing in Four Public Software Package Registries: Quantity, Quality, and Influencing Factors. - Taylor R. Schorlemmer; Kelechi G. Kalu; Luke Chigges; Kyung Myung Ko; Eman Abu Ishgair; Saurabh Bagchi; Santiago Torres-Arias; James C. Davis 001 (SP, 2024)

Signing in Four Public Software Package Registries: Quantity, Quality, and Influencing Factors. - Taylor R. Schorlemmer; Kelechi G. Kalu; Luke Chigges; Kyung Myung Ko; Eman Abdul-Muhd Abu Isghair; Saurabh Baghi; Santiago Torres-Arias; James C. Davis 001 (CoRR, 2024)

SoK: A Defense-Oriented Evaluation of Software Supply Chain Security. - Eman Abu Ishgair; Marcela S. Melara; Santiago Torres-Arias (CoRR, 2024)

An Industry Interview Study of Software Signing for Supply Chain Security. - Kelechi G. Kalu; Tanya Singla; Chinenye Okafor; Santiago Torres-Arias; James C. Davis 001 (CoRR, 2024)

DiVerify: Diversifying Identity Verification in Next-Generation Software Signing. - Chinenye L. Okafor; James C. Davis 001; Santiago Torres-Arias (CoRR, 2024)

Establishing Provenance Before Coding: Traditional and Next-Gen Signing. - Taylor R. Schorlemmer; Ethan H. Burmane; Kelechi G. Kalu; Santiago Torres-Arias; James C. Davis 001 (CoRR, 2024)

A Study of Malware Prevention in Linux Distributions. - Duc-Ly Vu; Trevor Dunlap; Karla Obermeier-Velazquez; Paul Gibert; John Speed Meyers; Santiago Torres-Arias (CoRR, 2024)

$ZTD_{ text{JAVA}}$: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies. - Paschal C. Amusuo; Kyle A. Robinson; Tanmay Singla; Huiyun Peng; Aravind Machiry; Santiago Torres-Arias; Laurent Simon; James C. Davis 001 (ICSE, 2025)

Establishing Provenance Before Coding: Traditional and Next-Generation Software Signing. - Taylor R. Schorlemmer; Ethan H. Burmane; Kelechi G. Kalu; Santiago Torres-Arias; James C. Davis 001 (IEEE Secur. Priv., 2025)

Why Johnny Signs with Sigstore: Examining Tooling as a Factor in Software Signing Adoption in the Sigstore Ecosystem. - Kelechi G. Kalu; Sofia Okorafor; Tanmay Singla; Santiago Torres-Arias; James C. Davis 001 (CoRR, 2025)

ARMS: A Vision for Actor Reputation Metric Systems in the Open-Source Software Supply Chain. - Kelechi G. Kalu; Sofia Okorafor; F. Betül Durak; Kim Laine; Radames Cruz Moreno; Santiago Torres-Arias; James C. Davis 001 (CoRR, 2025)