Mitigating Security Risks Via Code Movement

A computer program product comprising a non-transitory computer readable storage medium having program code embodied therewith, the program code executable by a computing system to cause the computing system to perform:

• performing on a computing system a source-to-sink reachability analysis of code of an application, wherein the source-to-sink teachability analysis is performed using a static analysis of the code and determines flows from sources of information to sinks that use the information;
• determining scopes for corresponding security sensitive operations using the determined flows, each of the security sensitive operations corresponding to statements in the code and one or more flows, wherein a scope for a security sensitive operation comprises a block of statements in the code that correspond to a set of one or more flows ending at a sink;
• and
• for each of one or more selected scopes, moving statements in a corresponding block of statements that are independent of a security sensitive operation in the block to a section of code before or after the block.