Determining security risks in software code

1. A computer-implemented method, comprising:

scanning, by at least one hardware processor, a software code to determine whether the software code includes an open source software (OSS) component;

for each OSS component included in the software code:

determining, by the at least one hardware processor, a security score for the OSS component, wherein the determining comprises:

determining an OSS project that develops the OSS component; and

determining the security score of the OSS component based on a security assessment of the OSS project; and

determining, by the at least one hardware processor, whether the OSS component meets a security policy by comparing the security score with a threshold; and

in response to determining that at least one OSS component does not meet the security policy, preventing, by the at least one hardware processor, the software code including the at least one OSS component from being compiled.

2. The method of claim 1 , further comprising:

generating a notification indicating the at least one OSS component having the security score that exceeds the threshold, wherein the notification includes a suggested replacement for the at least one OSS component.

3. The method of claim 1 , wherein the secure score is determined at a software service platform that includes an OSS depository.

4. The method of claim 1 , wherein the security score is determined based on a Common Vulnerabilities and Exposures (CVE) score of the OSS component.

5. The method of claim 1 , wherein the security score is determined based on a language type of the OSS component.

6. The method of claim 1 , wherein the security score is determined based on a release date of the OSS component.

7. The method of claim 1 , wherein the security score is determined based on a dependency of the OSS component on other OSS components.

8. A device, comprising:

at least one hardware processor; and

one or more computer-readable storage media coupled to the at least one hardware processor and storing programming instructions for execution by the at least one hardware processor, wherein the programming instructions, when executed, cause the at least one hardware processor to perform operations comprising:

scanning, by the at least one hardware processor, a software code to determine whether the software code includes an open source software (OSS) component;

for each OSS component included in the software code:

determining, by the at least one hardware processor, a security score for the OSS component, wherein the determining comprises:

determining an OSS project that develops the OSS component; and

determining the security score of the OSS component based on a security assessment of the OSS project; and

determining, by the at least one hardware processor, whether the OSS component meets a security policy by comparing the security score with a threshold; and

in response to determining that at least one OSS component does not meet the security policy, preventing, by the at least one hardware processor, the software code including the at least one OSS component from being compiled.

9. The device of claim 8 , the operations further comprising:

generating a notification indicating the at least one OSS component having the security score that exceeds the threshold, wherein the notification includes a suggested replacement for the at least one OSS component.

10. The device of claim 8 , wherein the secure score is determined at a software service platform that includes an OSS depository.

11. The device of claim 8 , wherein the security score is determined based on a Common Vulnerabilities and Exposures (CVE) score of the OSS component.

12. The device of claim 8 , wherein the security score is determined based on a language type of the OSS component.

13. The device of claim 8 , wherein the security score is determined based on a release date of the OSS component.

14. The device of claim 8 , wherein the security score is determined based on a dependency of the OSS component on other OSS components.

15. One or more non-transitory computer-readable media containing instructions which, when executed, cause a computing device to perform operations comprising: scanning, by at least one hardware processor, a software code to determine whether the software code includes an open source software (OSS) component;

for each OSS component included in the software code:

determining, by the at least one hardware processor, a security score for the OSS component, wherein the determining comprises:

determining an OSS project that develops the OSS component; and

determining the security score of the OSS component based on a security assessment of the OSS project; and

determining, by the at least one hardware processor, whether the OSS component meets a security policy by comparing the security score with a threshold; and

in response to determining that at least one OSS component does not meet the security policy, preventing, by the at least one hardware processor, the software code including the at least one OSS component from being compiled.

16. The one or more computer-readable media of claim 15 , the operations further comprising:

generating a notification indicating the at least one OSS component having the security score that exceeds the threshold, wherein the notification includes a suggested replacement for the at least one OSS component.

17. The one or more computer-readable media of claim 15 , wherein the secure score is determined at a software service platform that includes an OSS depository.

18. The one or more computer-readable media of claim 15 , wherein the security score is determined based on a Common Vulnerabilities and Exposures (CVE) score of the OSS component.

19. The one or more computer-readable media of claim 15 , wherein the security score is determined based on a language type of the OSS component.

20. The one or more computer-readable media of claim 15 , wherein the security score is determined based on a release date of the OSS component.