STOTTLER HENKE ASSOCIATES, INC — Department of Defense SBIR Phase I: AF203-CSO2

Description

Manual code review, involving developers checking the work of other developers, provides broad benefits such as improving software quality, sharing knowledge across the development team, mentoring new team members, improving adherence to code standards, and increased collaboration. It also functions as a check against both unintentional and malicious security threats. While manual code review provides significant benefits, manually examining 100% of code changes comes with a substantial cost. What is needed is a tool that can assist with the judicious application of code reviews to maximize the benefits while minimizing cost. We propose to develop SIEVE to intelligently reason about which pull requests (i.e., code changes) to review. Code changes that pass through SIEVE are automatically approved; those that do not are flagged for manual review. Our approach combines code-quality and security research with the information contained in pull-requests to intelligently and automatically reason about which pull requests to review. The resulting system, SIEVE, will initially be deployed as a Bitbucket plugin to work seamlessly with existing DevSecOps tools.