A large scale analysis of code security in public repositories

Cybersecurity is a growing concern for the software development sector, as insecure code and insecure software development practices lead to dangerous vulnerabilities in the released products. We propose CONSOLE, designed to boost cybersecurity for software development with an automated, unified platform of tools and services. The proposed framework integrates static and dynamic code analysis tools, real-time protection mechanisms, and adaptive training services. Multiple open-source tools for Static Application Security Testing offer a wide coverage of supported programming languages and types of vulnerabilities that can be detected. The code analysis features of the proposed platform were used in a large scale analysis on 10,855 public repositories. More than 60% of the analyzed repositories contained verified security issues, which highlights the need for automatic code evaluation as a standard practice in the software development pipeline. While popular software projects are usually more secure, having less defects per Megabyte of code, they are not shielded from security issues. The vulnerabilities present in popular projects are likely to have a greater impact in production environments. The large scale analysis results can be used to improve CONSOLE. The paper proposes a strategy for mitigating the False Positives, focusing on prevalent types of alerts and prioritizing them so the developers will be able to examine the most serious issues first. This paper brings awareness on the security defects found in common software projects and proposes the CONSOLE platform as a solution to automatically detect and correct these defects during the software development lifecycle.