Granted Patent B2

US 12,730,921 · App. 18/949,735 · Granted Sep 8, 2026

Inventors: Eric Sheridan (Lewes, DE); Harshit Naresh Chitalia (Mountain View, CA); Harshil Parikh (San Jose, CA)

Assignee: Checkmarx Ltd.

G06F21/6218

Abstract

Claims (78)

1 . A computer-implemented method for facilitating identification of sensitive data access based on source-code analysis, the method comprising:

determining whether a repository in a source-code management platform is pertinent to security;

in response the repository being pertinent to security, determining whether a respective source code file in the repository is pertinent to security;

in response the source code file being pertinent to security:

determining a set of symbols from the source code file; and

determining, based on the set of symbols, whether the source code file accesses sensitive data; and

in response to the source code file accessing sensitive data, presenting information associated with the source code file in a user interface,

wherein determining whether the source code file accesses the sensitive data comprises:

generating the set of symbols from the source code file by tokenizing code in the source code file using a tokenizer;

applying a set of rules on the set of symbols, wherein a respective rule corresponds to presence of a keyword indicating the sensitive data; and

in response to determining a match between the set of rules and a symbol, determining that the source code file accesses the sensitive data,

wherein the tokenizer is a language-agnostic tokenizer applicable to a plurality of programming languages.

2 . The computer-implemented method of claim 1 , wherein determining whether the repository is pertinent to security comprises:

applying an exclusion filter to the repository, wherein the exclusion filter indicates whether a non-security-related keyword is associated with the repository; and

in response to the exclusion filter matching the repository, determining that the repository is irrelevant to security.

3 . The computer-implemented method of claim 1 , wherein determining whether the source code file is pertinent to security comprises:

applying, in order, an inclusion filter and an exclusion filter to the source code file, wherein the inclusion filter indicates whether a security-related keyword is associated with the source code file, and wherein the exclusion filter indicates whether a non-security-related keyword is associated with the source code file; and

in response to the inclusion filter matching the source code file and the exclusion filter not matching the source code file, determining that the source code file is pertinent to security.

4 . The computer-implemented method of claim 3 , wherein the security-related keyword is represented as a regular expression in the inclusion filter, and wherein the non-security-related keyword is represented as a regular expression in the exclusion filter.

5 . The computer-implemented method of claim 1 , wherein the keyword indicating the sensitive data is represented as a regular expression in the rule.

6 . The computer-implemented method of claim 1 , wherein the keyword indicating the sensitive data corresponds to one of:

a credit card number;

a tax identification number (TIN);

personally identifiable information;

authentication credentials; and

personal health information.

7 . The computer-implemented method of claim 1 , further comprising:

determining an alert configured to be triggered in response to the source code file accessing sensitive data; and

presenting the information in the user interface in response to the alert being triggered.

8 . The computer-implemented method of claim 1 , further comprising:

determining a set of repositories associated with a tag in the source-code management platform, wherein the tag corresponds to an organization; and

traversing a respective repository associated with the tag for determining pertinence to security.

9 . A non-transitory computer-readable storage medium storing instructions that when executed by a processor of a computing system cause the processor to perform a method, the method comprising:

determining whether a repository in a source-code management platform is pertinent to security;

in response the repository being pertinent to security, determining whether a respective source code file in the repository is pertinent to security;

in response the source code file being pertinent to security:

determining a set of symbols from the source code file; and

determining, based on the set of symbols, whether the source code file accesses sensitive data; and

in response to the source code file accessing sensitive data, presenting information associated with the source code file in a user interface,

wherein determining whether the source code file accesses the sensitive data comprises:

generating the set of symbols from the source code file by tokenizing code in the source code file using a tokenizer;

applying a set of rules on the set of symbols, wherein a respective rule corresponds to presence of a keyword indicating the sensitive data; and

in response to determining a match between the set of rules and a symbol, determining that the source code file accesses the sensitive data,

wherein the tokenizer is a language-agnostic tokenizer applicable to a plurality of programming languages.

10 . The non-transitory computer-readable storage medium of claim 9 , wherein determining whether the repository is pertinent to security comprises:

applying an exclusion filter to the repository, wherein the exclusion filter indicates whether a non-security-related keyword is associated with the repository; and

in response to the exclusion filter matching the repository, determining that the repository is irrelevant to security.

11 . The non-transitory computer-readable storage medium of claim 9 , wherein determining whether the source code file is pertinent to security comprises:

applying, in order, an inclusion filter and an exclusion filter to the source code file, wherein the inclusion filter indicates whether a security-related keyword is associated with the source code file, and wherein the exclusion filter indicates whether a non-security-related keyword is associated with the source code file; and

in response to the inclusion filter matching the source code file and the exclusion filter not matching the source code file, determining that the source code file is pertinent to security.

12 . The non-transitory computer-readable storage medium of claim 11 , wherein the security-related keyword is represented as a regular expression in the inclusion filter, and wherein the non-security-related keyword is represented as a regular expression in the exclusion filter.

13 . The non-transitory computer-readable storage medium of claim 9 , wherein the keyword indicating the sensitive data is represented as a regular expression in the rule.

14 . The non-transitory computer-readable storage medium of claim 9 , wherein the keyword indicating the sensitive data corresponds to one of:

a credit card number;

a tax identification number (TIN);

personally identifiable information;

authentication credentials; and

personal health information.

15 . The non-transitory computer-readable storage medium of claim 9 , wherein the method further comprises:

determining an alert configured to be triggered in response to the source code file accessing sensitive data; and

presenting the information in the user interface in response to the alert being triggered.

16 . The non-transitory computer-readable storage medium of claim 9 , wherein the method further comprises:

determining a set of repositories associated with a tag in the source-code management platform, wherein the tag corresponds to an organization; and

traversing a respective repository associated with the tag for determining pertinence to security.

17 . A computer system, comprising:

a processor;

a non-transitory computer-readable storage medium storing instructions that when executed by the processing resource cause the computer system to:

determine whether a repository in a source-code management platform is pertinent to security;

in response the repository being pertinent to security, determine whether a respective source code file in the repository is pertinent to security;

in response the source code file being pertinent to security:

determine a set of symbols from the source code file; and

determine, based on the set of symbols, whether the source code file accesses sensitive data; and

in response to the source code file accessing sensitive data, present information associated with the source code file in a user interface,

wherein determining whether the source code file accesses the sensitive data comprises:

generating the set of symbols from the source code file by tokenizing code in the source code file using a tokenizer;

applying a set of rules on the set of symbols, wherein a respective rule corresponds to presence of a keyword indicating the sensitive data; and

in response to determining a match between the set of rules and a symbol, determining that the source code file accesses the sensitive data,

wherein the tokenizer is a language-agnostic tokenizer applicable to a plurality of programming languages.

Assignments (3)

Continuity (2)

References Cited (9)