Replication package for: "SES-8: An ISO/IEC 25010--Based Software Security Measurement Framework"

Software security is multi-dimensional and largely latent; it is therefore assessed indirectly through explicit, repeatableevidence. SES-8 is an ISO/IEC~25010--based software security measurement framework that operationalizes security as fiveseparately reported subconstructs: confidentiality, integrity, authenticity, accountability, and non-repudiation. Theprimary reporting object is a per-release subconstruct profile rather than a single aggregated score. Indicators aretreated as bounded evidence about latent properties, and CVSS is used only as a severity descriptor. SES-8 specifiesmeasurement-process controls---versioned inventories, pinned tooling, coverage/missingness diagnostics, and trend-breakrules---to support traceable reporting under stable instrumentation. The framework also states falsifiable hypotheses toguide future criterion-based validation. An illustrative computation on OWASP Juice Shop v9.3.1 shows howCWVB$_{\text{profile}}$ and IWVB$_{\text{profile}}$ are produced; other components are marked not measured. This package contains the data, code, and documentation to replicate the SES-8 feasibility pilot on OWASP Juice Shop v9.3.1.