Granted Patent B2

US 12,743,522 · App. 18/098,075 · Granted Sep 22, 2026

Inventors: Jeffrey Murray Rowell (Aurora, CO); Charles James Manser (Clearwater, FL)

Assignee: CHARTER COMMUNICATIONS OPERATING, LLC

G06F21/577G06F8/71

Abstract

Claims (74)

1 . A method comprising:

performing an initial security scan of code;

storing the initially security scanned code in a version control system repository server as published code;

obtaining a command to download the published code from the version control system repository server;

quarantining the published code and running a subsequent security scan on the published code in response to the obtaining of the command to download the published code and while it is quarantined, wherein the published code and the initially security scanned code is the same code; and

based on an acceptable result of the subsequent security scan, releasing the quarantine and permitting download of the initially security scanned code by allowing the command to download to proceed;

wherein the acceptable result of the subsequent security scan is based on a threshold, wherein the threshold is selected specifically for the initially security scanned code.

2 . The method of claim 1 , wherein:

quarantining the published code and running the subsequent security scan on the published code while it is quarantined comprises placing the published code in a quarantine directory and running the subsequent security scan on the published code while it resides in the quarantine directory; and

releasing the quarantine and permitting download of the initially security scanned code comprises moving the initially security scanned code to a separate directory and permitting download of the initially security scanned code from the separate directory.

3 . The method of claim 2 , wherein running the security scan yields a vulnerability score, further comprising:

comparing the vulnerability score to the threshold, wherein the acceptable result of the subsequent security scan is based on the comparison of the vulnerability score to the threshold.

4 . The method of claim 3 , wherein the acceptable result of the subsequent security scan is based on the vulnerability score not exceeding the threshold, the threshold comprising a maximum permissible value of vulnerability score.

5 . The method of claim 2 , wherein the command to download the published code comprises a first command and the published code comprises first code, further comprising:

obtaining a second command to download second code from the version control system repository server;

responsive to the obtained second command, placing the second code in the quarantine directory and running a security scan on the second code while it resides in the quarantine directory; and

based on an unacceptable result of the security scan on the second code, refraining from moving the second code to the separate directory, and refusing download of the second code.

6 . The method of claim 5 , wherein the threshold comprises a first threshold and wherein running the security scan on the first and second code yields first and second vulnerability scores, further comprising comparing the first vulnerability score to the first threshold and comparing the second vulnerability score to a second threshold, different than the first threshold, wherein the acceptable result of the security scan on the first code is based on the comparison of the first vulnerability score to the first threshold and the unacceptable result of the security scan on the second code is based on the comparison of the second vulnerability score to the second threshold.

7 . The method of claim 5 , further comprising, based on the unacceptable result of the security scan on the second code:

remediating at least one security issue with the second code;

running a security scan on the remediated second code while it resides in the quarantine directory; and

based on an acceptable result of the security scan on the remediated second code, moving the remediated second code to the separate directory and permitting download of the remediated second code from the separate directory.

8 . The method of claim 5 , further comprising, based on the unacceptable result of the security scan on the second code, returning an error message to a provider of the command to download the second code.

9 . The method of claim 8 , wherein the error message includes at least one specific identified vulnerability, a Common Vulnerability Scoring System (CVSS) score, and an identification of specific lines of code that are vulnerable.

10 . The method of claim 9 , wherein the error message further includes at least one link to documentation on how to resolve the at least one specific identified vulnerability.

11 . The method of claim 2 , wherein running the security scan comprises employing a script to carry out at least software composition analysis (SCA).

12 . The method of claim 2 , wherein running the security scan comprises employing a script to carry out at least static application security testing (SAST).

13 . The method of claim 2 , wherein running the security scan comprises employing a script to carry out at least dynamic application security testing (DAST).

14 . The method of claim 2 , further comprising, prior to obtaining the command to download the published code from the version control system repository server:

obtaining a command to upload the code to the version control system repository server; and

responsive to the obtained command to upload the code, placing the code in the quarantine directory and performing the initial security scan on the code while it resides in the quarantine directory;

wherein the storing of the initially security scanned code is based on an acceptable result of the initial security scan, and includes moving the uploaded code to the separate directory.

15 . The method of claim 14 , wherein the command to upload the code is received from a developer and the command to download the published security scanned code is received from a user, different than the developer.

16 . The method of claim 14 , wherein the command to download the published code comprises a first download command, the command to upload the code comprises a first upload command, and the code comprises first code, further comprising:

obtaining a second upload command to upload second code to the version control system repository server;

responsive to the obtained second upload command to upload the second code, placing the second code in the quarantine directory and running an intake security scan on the second code while it resides in the quarantine directory;

based on an acceptable result of the intake security scan on the second code, moving the second code to the separate directory;

after the acceptable result of the intake security scan on the second code, and the moving of the second code to the separate directory, obtaining a second download command to download the second code from the version control system repository server;

responsive to the obtained second download command, placing the second code in the quarantine directory and running a download security scan on the second code while it resides in the quarantine directory; and

based on an unacceptable result of the download security scan on the second code, refraining from moving the second code to the separate directory, and refusing download of the second code.

17 . The method of claim 16 , wherein the download security scan on the second code takes into account new vulnerability information not available for the intake security scan on the second code.

18 . A non-transitory computer readable medium comprising computer executable instructions which when executed by a computer cause the computer to perform a method comprising:

performing an initial security scan of code;

storing the initially security scanned code in a version control system repository server as published code;

obtaining a command to download the published code from the version control system repository server;

quarantining the published code and running a subsequent security scan on the published code in response to the obtaining the command to download the published code and while it is quarantined, wherein the published code and the initially security scanned code is the same code; and

based on an acceptable result of the subsequent security scan, releasing the quarantine and permitting download of the initially security scanned code by allowing the command to download to proceed;

wherein the acceptable result of the subsequent security scan is based on a threshold, wherein the threshold is selected specifically for the initially security scanned code.

19 . The non-transitory computer readable medium of claim 18 , wherein, in the method performed by the computer:

quarantining the published code and running the subsequent security scan on the published code while it is quarantined comprises placing the published code in a quarantine directory and running the subsequent security scan on the published code while it resides in the quarantine directory; and

releasing the quarantine and permitting download of the initially security scanned code comprises moving the initially security scanned code to a separate directory and permitting download of the initially security scanned code from the separate directory.

20 . A system comprising:

a memory; and

at least one processor, coupled to the memory, and operative to:

perform an initial security scan of code;

store the initially security scanned code in a version control system repository server as published code;

obtain a command to download published code from the version control system repository server;

quarantine the published code and run a subsequent security scan on the published code in response to the obtaining of the command to download the published code and while it is quarantined, wherein the published code and the initially security scanned code is the same code; and

based on an acceptable result of the subsequent security scan, release the quarantine and permit download of the initially security scanned code by allowing the command to download to proceed;

wherein the acceptable result of the subsequent security scan is based on a threshold, wherein the threshold is selected specifically for the initially security scanned code.

21 . The system of claim 20 , wherein the at least one processor is operative to:

quarantine the published code and run the subsequent security scan on the published code while it is quarantined by placing the published code in a quarantine directory and running the subsequent security scan on the published code while it resides in the quarantine directory; and

release the quarantine and permit download of the initially security scanned code by moving the initially security scanned code to a separate directory and permitting download of the initially security scanned code from the separate directory.

22 . The system of claim 21 , wherein the at least one processor running the subsequent security scan yields a vulnerability score, and wherein the at least one processor is further operative to compare the vulnerability score to the threshold, wherein the acceptable result of the subsequent security scan is based on the comparison of the vulnerability score to the threshold.

23 . The system of claim 22 , wherein the acceptable result of the subsequent security scan is based on the vulnerability score not exceeding the threshold, the threshold comprising a maximum permissible value of vulnerability score.

24 . The system of claim 21 , wherein the command to download the published code comprises a first command and the published code comprises first code, and wherein the at least one processor is further operative to:

obtain a second command to download second code from the version control system repository server;

responsive to the obtained second command, place the second code in the quarantine directory and run a security scan on the second code while it resides in the quarantine directory; and

based on an unacceptable result of the security scan on the second code, refrain from moving the second code to the separate directory, and refuse download of the second code.

25 . The system of claim 24 , wherein:

the threshold comprises a first threshold;

running the security scan on the first and second code yields first and second vulnerability scores;

the at least one processor is further operative to compare the first vulnerability score to the first threshold and compare the second vulnerability score to a second threshold, different than the first threshold; and

the acceptable result of the security scan on the first code is based on the comparison of the first vulnerability score to the first threshold and the unacceptable result of the security scan on the second code is based on the comparison of the second vulnerability score to the second threshold.

Assignments (1)

Continuity (1)

References Cited (17)