Static Security Scanner for Applications in a Remote Network Management Platform

A method comprising:

• receiving, by a scanner application and from a client device, a request to scan a particular application, wherein a computational instance of a remote network management platform hosts the particular application, and wherein the particular application is based on a unit of program code, uses one or more database tables, and defines one or more user roles with respect to accessing the program code and the database tables;
• in response to receiving the request to scan the particular application, retrieving, by the scanner application, the unit of program code, the database tables, and the user roles from the computational instance;
• conducting, by the scanner application, a static security scan of the unit of program code, the database tables, and the user roles by applying a set of rules that define security vulnerabilities that can be found in hosted applications on the remote network management system, wherein the rules take into account (i) relationships between the user roles and the unit of program code, and (ii) relationships between the user roles and the database table;
• and
• transmitting, by the scanner application and to the client device, a representation of a web page that contains a categorized list of observed security vulnerabilities of the particular application that were found by the static security scan.

An article of manufacture including a non-transitory computer-readable medium, having stored thereon program instructions for a scanner application that, upon execution by a computing device, cause the computing device to perform operations comprising:

• receiving, from a client device, a request to scan a particular application, wherein a computational instance of a remote network management platform hosts the particular application, and wherein the particular application is based on a unit of program code, uses one or more database tables, and defines one or more user roles with respect to accessing the program code and the database tables;
• in response to receiving the request to scan the particular application, retrieving the unit of program code, the database tables, and the user roles from the computational instance;
• conducting a static security scan of the unit of program code, the database tables, and the user roles by applying a set of rules that define security vulnerabilities that can be found in hosted applications on the remote network management system, wherein the rules take into account (i) relationships between the user roles and the unit of program code, and (ii) relationships between the user roles and the database table;
• and
• transmitting, to the client device, a representation of a web page that contains a categorized list of observed security vulnerabilities of the particular application that were found by the static security scan.