一句话：将 PR 工作流视为统一整体，通过经验证据和工具解决 PR 延迟与安全风险，并提出基于 LLM 的安全警报系统。
现代开源软件开发以 pull request（PR）为核心协调单元，用于评审、CI/CD 验证和修复安全漏洞。然而现有研究孤立地考察 PR 响应性、CI/CD 性能和漏洞处理，忽视了延迟与安全风险在同一 PR 工作流中累积。本论文将基于 PR 的开发（PBD）视为统一工作流，研究次优 PR 管理如何造成可避免的 PR 延迟和更高的安全风险。论文提供经验证据和工具来应对这些耦合结果：一方面通过刻画和改进关键效率瓶颈，为减少 PR 延迟提供可操作指导；另一方面开发基于 LLM 的低噪声、证据驱动的安全警报系统，为改进漏洞管理提供建议。总体上，论文通过一个 PR 工作流将效率与安全连接起来。
Pull-request-based development (PBD) is the dominant workflow in modern open-source software (OSS), where pull requests (PRs) are the central coordination unit for review, CI/CD validation, and fixing security vulnerabilities. Existing research studies PR responsiveness, CI/CD performance, and vulnerability handling in isolation, even though delays and security risks accumulate through the same PR-mediated workflow. To address this gap, this thesis treats PBD as a unified workflow and investigates how suboptimal PR management creates avoidable PR delays and increased security risk. We provide empirical evidence and tools to address these coupled outcomes. Overall, the thesis connects efficiency and security through one PR-based workflow. It provides actionable guidance for reducing PR delays by characterizing and improving key efficiency bottlenecks, and offers recommendations for improving vulnerability management by developing an LLM-based, low-noise, evidence-driven security alert system.