Welcome to the public repository for the additional content of the paper "Security Risk Management for Configurable Software Systems: A Critical Reflection", submitted at the SPLC 2023. This repository provides additional information to the conducted systematic literature review, including the following files: fetched_results_SPLC2023.csv: sheet containing all papers fetched from IEEEXplore, Scopus, and the ACM Guide to Computing Literature. analysis_sheet_SPLC2023.csv: sheet containing information regarding the analysis results of 50 included papers based on the extraction criteria. We defined the following selection criteria: The paper is written in English. The paper has been published between 2013 and 2022. The paper is a peer-reviewed conference paper or journal articles, or book chapters (e.g., excluding books, posters). The paper hast at least four pages. The paper focuses on security-related risk management of configurable systems based on product-line engineering. We searched in IEEEXplore (22 papers), Scopus (54 papers), and the ACM Guide to Computing Literature (582 papers). The fetched papers are listed in fetched_results_SPLC2023.csv. The following search string was applied on March 15, 2023: ("security") AND ("risk" OR "threat" OR "test*" OR "model*" OR "management" OR "assess*" OR "evaluat*") AND ("software product line") We removed 39 duplicates. After title (198 papers), abstract (51 papers), and full-text (37 papers) selection, we employed two iterations of backwards and forwards snowballing, resulting in 50 paper for full-text analysis. An analysis sheet was created (analysis_sheet_SPLC2023.csv) containing all extraction criteria.