Discovering and remediating hidden secrets in code files

Abstract

Disclosed embodiments relate to systems and methods for discovering and remediating hidden secrets in code files. Techniques include accessing an element of source code for analysis, performing a static analysis of the element of source code, and generating a control flow representation that identifies a plurality of functions and a sequence of functions associated with the element of the source code. The techniques may further include determining a probability of a hidden secret being included in the element of source code and performing a security action of at least one of: generating an alert, displaying a visual indication of the probability, generating a report associated with the hidden secret, sending data associated with the probability to a machine learning system for training the machine learning system, or a remediating action associated with the hidden secret.

What is claimed is: 
     
         1 . A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for inspecting source code files for the presence of hidden secrets, comprising:
 accessing an element of source code for analysis;   performing a static analysis of the element of source code;   generating, based on the static analysis, a control flow representation of the element of source code, wherein the control flow representation identifies a plurality of functions and a sequence of the functions associated with the element of source code;   determining, based on the control flow representation, a probability of a hidden secret being included in the element of source code; and   performing, based on the probability, a security action comprising at least one of: 
 generating an alert, 
 displaying a visual indication of the probability, 
 generating a report associated with the hidden secret, 
 sending data associated with the probability to a machine learning system for training the machine learning system, or 
 a remediating action associated with the hidden secret. 
   
     
     
         2 . The non-transitory computer-readable medium of  claim 1 , wherein the static analysis includes at least one of:
 identifying a communications protocol used by the element of source code,   identifying a package used by the element of source code,   identifying one or more function calls of the element of source code,   identifying a file import associated with the element of source code, or   identifying one or more headers of the element of source code as suspicious.   
     
     
         3 . The non-transitory computer-readable medium of  claim 1 , wherein the probability of the hidden secret included in the element of source code is based on an external file identified in the element of source code. 
     
     
         4 . The non-transitory computer-readable medium of  claim 1 , wherein the probability of the hidden secret included in the element of source code is based on the identification of an encryption or encoding algorithm in the element of source code. 
     
     
         5 . The non-transitory computer-readable medium of  claim 1 , wherein the probability of the hidden secret being included in the element of source code is specific to a particular location in the element of source code. 
     
     
         6 . The non-transitory computer-readable medium of  claim 1 , wherein the control flow representation indicates a plurality of application programming interface calls according to the element of source code. 
     
     
         7 . The non-transitory computer-readable medium of  claim 1 , wherein the control flow representation indicates a plurality of application programming interface calls according to the element of source code. 
     
     
         8 . The non-transitory computer-readable medium of  claim 1 , wherein the remediating action includes at least one of: sending an identification of the hidden secret to an external platform, rotating the hidden secret to a new value, deleting the hidden secret, logging the hidden secret, or invalidating the hidden secret. 
     
     
         9 . The non-transitory computer-readable medium of  claim 1 , wherein the remediating action includes at least a partial integration with a security platform that manages secrets. 
     
     
         10 . The non-transitory computer-readable medium of  claim 1 , wherein the operations further include a verification of the hidden secret. 
     
     
         11 . The non-transitory computer-readable medium of  claim 1 , wherein the probability is based at least in part on an output of the machine learning system. 
     
     
         12 . The non-transitory computer-readable medium of  claim 1 , wherein the security action is selected based at least in part on an output of the machine learning system. 
     
     
         13 . A computer-implemented method for inspecting source code files for the presence of hidden secrets, comprising:
 accessing an element of source code for analysis;   performing a static analysis of the element of source code;   generating, based on the static analysis, a control flow representation of the element of source code, wherein the control flow representation identifies a plurality of functions and a sequence of the functions associated with the element of source code;   determining, based on the control flow representation, a probability of a hidden secret being included in the element of source code; and   performing, based on the probability, a security action comprising at least one of: 
 generating an alert, 
 displaying a visual indication of the probability, 
 generating a report associated with the hidden secret, 
 sending data associated with the probability to a machine learning system for training the machine learning system, or 
 a remediation action associated with the hidden secret. 
   
     
     
         14 . The computer-implemented method of  claim 13 , wherein accessing the element of source code for analysis comprises receiving the element of source code from a code repository. 
     
     
         15 . The computer-implemented method of  claim 13 , wherein the performing of the static analysis of the element of source code is prioritized based on a preliminary analysis of the element of source code. 
     
     
         16 . The computer-implemented method of  claim 15 , wherein the preliminary analysis of the element of source code includes evaluation of nonexecutable program-readable language associated with the element of source code. 
     
     
         17 . The computer-implemented method of  claim 15 , wherein the preliminary analysis of the element of source code includes identifying a likelihood that the element of source code uses one or more secrets. 
     
     
         18 . The computer-implemented method of  claim 13 , further comprising generating a risk assessment for the element of source code. 
     
     
         19 . The computer-implemented method of  claim 18 , wherein the risk assessment is based on the probability and at least one of:
 an application or platform associated with the element of source code,   whether the hidden secret is single-factor or multi-factor,   a type of the hidden secret, or   a sensitivity of a target resource at which the hidden secret may be used.   
     
     
         20 . The computer-implemented method of  claim 18 , wherein the security action is selected based on the risk assessment.