Document Open Access Logo

Catching What the Borrow Checker Can't: Towards Serious Game-Based Security Training for Rust Developers (Short Paper)

Authors Frederico d'Abreu , Tiago Espinha Gasiba , Sathwik Amburi , Maria Pinto-Albuquerque

PDF

File

Thumbnail PDF
PDF
OASIcs.ICPEC.2026.16.pdf
  • Filesize: 0.75 MB
  • 8 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Security and privacy → Software and application security
  • Security and privacy → Software security engineering
  • Social and professional topics → Computing education
  • Social and professional topics → Computing education programs
Keywords
  • Rust
  • Secure Coding Training
  • Secure Software Development
  • Serious Games
  • Gamification
  • Industry

Metrics

Abstract

Cybersecurity incidents cause significant financial damage to organizations, making secure software development a critical industry priority. Although Rust offers strong memory safety guarantees, developers can still introduce security vulnerabilities through improper coding practices. In this paper, we present the preliminary design of a serious game for secure Rust coding training in an industrial setting. We investigate real-world Rust vulnerabilities, map (five of) them to CWEs, and propose challenge scenarios alongside a structured evaluation protocol for validation by industry security experts. Our design incorporates defense-oriented coding tasks, a three-level AI-powered hint system, and automated backend evaluation, grounded in established pedagogical principles such as situated learning and cognitive load management. This work provides a foundation for future implementation and empirical evaluation of learning outcomes with professional software developers.

Cite As Get BibTex

Frederico d'Abreu, Tiago Espinha Gasiba, Sathwik Amburi, and Maria Pinto-Albuquerque. Catching What the Borrow Checker Can't: Towards Serious Game-Based Security Training for Rust Developers (Short Paper). In 7th International Computer Programming Education Conference (ICPEC 2026). Open Access Series in Informatics (OASIcs), Volume 145, pp. 16:1-16:8, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/OASIcs.ICPEC.2026.16

Author Details

Frederico d'Abreu
  • Instituto Universitário de Lisboa (ISCTE-IUL), Portugal
Tiago Espinha Gasiba
  • Siemens AG, Munich, Germany
Sathwik Amburi
  • Siemens AG, Munich, Germany
Maria Pinto-Albuquerque
  • ISTAR, Instituto Universitário de Lisboa (ISCTE-IUL), Portugal

Funding

This work was partially supported by national funds through Fundação para a Ciência e Tecnologia, I.P. (FCT), ISTAR-Iscte Pluriannual Project UID/04466/2025 (https://doi.org/ 10.54499/UID/04466/2025).

Acknowledgements

The authors would like to thank the industrial partners who supported this research.

References

  1. Christopher J Berisford, Leighton Blackburn, Jennifer M Ollett, Thomas B Tonner, Chun San Hugh Yuen, Ryan Walton, and Olakunle Olayinka. Can gamification help to teach cybersecurity? In 2022 20th International Conference on Information Technology Based Higher Education and Training (ITHET), pages 1-9, 2022. URL: https://doi.org/10.1109/ITHET56107.2022.10031716.
  2. Mohan Cui, Shuran Sun, Hui Xu, and Yangfan Zhou. Is unsafe an achilles' heel? a comprehensive study of safety requirements in unsafe rust programming. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering, ICSE '24, New York, NY, USA, 2024. Association for Computing Machinery. URL: https://doi.org/10.1145/3597503.3639136.
  3. Denise Daniels, Joon Suk Lee, Hui Chen, and Kostadin Damevski. Utilizing real-world software vulnerabilities to enhance secure programming education. In 2024 IEEE Frontiers in Education Conference (FIE), pages 1-8, 2024. URL: https://doi.org/10.1109/FIE61694.2024.10893584.
  4. Tiago Espinha Gasiba, Kristian Beckers, Santiago Suppan, and Filip Rezabek. On the requirements for serious games geared towards software developers in the industry. In 2019 IEEE 27th International Requirements Engineering Conference (RE), pages 286-296, 2019. URL: https://doi.org/10.1109/RE.2019.00038.
  5. Tiago Espinha Gasiba, Andrei-Cristian Iosif, Santiago Suppan, Ulrike Lechner, and Maria Pinto-Albuquerque. Reflections on training next-gen industry workforce on secure software development. In Proceedings of the 5th European Conference on Software Engineering Education, ECSEE '23, pages 1-10, New York, NY, USA, 2023. Association for Computing Machinery. URL: https://doi.org/10.1145/3593663.3593665.
  6. Tiago Espinha Gasiba and Ulrike Lechner. Raising secure coding awareness for software developers in the industry. In 2019 IEEE 27th International Requirements Engineering Conference Workshops (REW), pages 141-143, 2019. URL: https://doi.org/10.1109/REW.2019.00030.
  7. Tiago Espinha Gasiba, Ulrike Lechner, Maria Pinto-Albuquerque, and Daniel Méndez. Is secure coding education in the industry needed? An investigation through a large scale survey. In 2021 IEEE/ACM 43rd International Conference on Software Engineering: Software Engineering Education and Training (ICSE-SEET), pages 241-252, 2021. URL: https://doi.org/10.1109/ICSE-SEET52601.2021.00034.
  8. Tiago Gasiba, Ulrike Lechner, Maria Pinto-Albuquerque, and Alae Zouitni. Design of secure coding challenges for cybersecurity education in the industry. In Martin Shepperd, Fernando Brito e Abreu, Alberto Rodrigues da Silva, and Ricardo Pérez-Castillo, editors, Quality of Information and Communications Technology, pages 223-237, Cham, 2020. Springer International Publishing. URL: https://doi.org/10.1007/978-3-030-58793-2_18.
  9. Ralf Jung, Jacques-Henri Jourdan, Robbert Krebbers, and Derek Dreyer. Safe systems programming in rust. Communications of the ACM, 64(4):144-152, 2021. URL: https://doi.org/10.1145/3418295.
  10. Hao-Ping (Hank) Lee, Advait Sarkar, Lev Tankelevitch, Ian Drosos, Sean Rintel, Richard Banks, and Nicholas Wilson. The impact of generative AI on critical thinking: Self-reported reductions in cognitive effort and confidence effects from a survey of knowledge workers. In CHI 2025, April 2025. URL: https://dl.acm.org/doi/full/10.1145/3706598.3713778.
  11. Werner Siegfried Ravyse, A. Seugnet Blignaut, Verona Leendertz, and Alex Woolner. Success factors for serious games to enhance learning: a systematic review. Virtual Real., 21(1):31-58, March 2017. URL: https://doi.org/10.1007/s10055-016-0298-4.
  12. Ita Ryan, Utz Roedig, and Klaas-Jan Stol. Training developers to code securely: Theory and practice. In Proceedings of the 2024 ACM/IEEE 4th International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) and 2024 IEEE/ACM Second International Workshop on Software Vulnerability, EnCyCriS/SVM '24, pages 37-44, New York, NY, USA, 2024. Association for Computing Machinery. URL: https://doi.org/10.1145/3643662.3643956.
  13. Ita Ryan, Utz Roedig, and Klaas-Jan Stol. Software security is your highest priority. Do your developers know that? IEEE Security & Privacy, PP:2-10, January 2026. URL: https://doi.org/10.1109/MSEC.2026.3670641.
  14. John Sweller, Jeroen J. G. van Merriënboer, and Fred Paas. Cognitive architecture and instructional design: 20 years later. Educational Psychology Review, 31(2):261-292, 2019. URL: https://doi.org/10.1007/s10648-019-09465-5.
  15. Tiange Zhao, Tiago Gasiba, Ulrike Lechner, and Maria Pinto-Albuquerque. Thriving in the era of hybrid work: Raising cybersecurity awareness using serious games in industry trainings. Journal of Systems and Software, 210:111946, 2024. URL: https://doi.org/10.1016/j.jss.2023.111946.
  16. Xiaoye Zheng, Zhiyuan Wan, Yun Zhang, Rui Chang, and David Lo. A closer look at the security risks in the rust ecosystem. ACM Trans. Softw. Eng. Methodol., 33(2), December 2023. URL: https://doi.org/10.1145/3624738.
  17. Shuqi Zuo, Qi Yang, Tianyi Gao, Zarin Tasnim Progga, and Jinjin Shen. How security coding knowledge impact software quality: An empirical study of stack overflow security issues. In 2025 25th International Conference on Software Quality, Reliability and Security (QRS), pages 727-738, 2025. URL: https://doi.org/10.1109/QRS65678.2025.00076.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2026 Schloss Dagstuhl – LZI GmbH Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact