Ruining Yang

About Me

I am a third-year Ph.D. student in Computer Science at Stony Brook University, where I am a member of the PragSec Lab and advised by Prof. Nick Nikiforakis. My research is in systems and network security, with a focus on the security of Infrastructure as Code (IaC), software supply chains, and credential leakage in the wild.

I build measurement studies and tools that uncover how attackers abuse trust in modern infrastructure tooling, and how secrets exposed in public repositories are discovered and weaponized.

Research Interests

Infrastructure as Code security: residual trust, remote-reference hijacking, security hardening adoption
Software supply chain security: dependency and remote-reference attack surfaces
Credential leakage measurement: honeypots, honeytokens, and attacker behavior in the wild

News

[Jun. 2026] One paper accepted at PST 2026.
[Mar. 2026] One paper accepted at CODASPY 2026.

Publications

Measuring Security Hardening Adoption in Infrastructure as Code: An Empirical Study of Public Repositories

Ruining Yang, Nick Nikiforakis

International Conference on Privacy, Security and Trust (PST), 2026.

To appear

Infrastructure as Compromise: Abusing Residual Trust in Infrastructure as Code Tools

Ruining Yang, Narong Chaiwut, Nick Nikiforakis

ACM Conference on Data and Application Security and Privacy (CODASPY), 2026.

PDF Cite

@inproceedings{yang2026infrastructure,
  title={Infrastructure as Compromise: Abusing Residual Trust in Infrastructure as Code Tools},
  author={Yang, Ruining and Chaiwut, Narong and Nikiforakis, Nick},
  booktitle={Proceedings of the Sixteenth ACM Conference on Data and Application Security and Privacy},
  pages={126--137},
  year={2026}
}

User Perception of Login Notification Emails

Ruining Yang

M.S. Thesis, The George Washington University, 2023.

About Me

Research Interests

News

Publications

Services

Artifact Evaluation Committee