System and method for prioritizing and remediating defect risk in source code

A system comprising:

• a processor;
• and
• a computer-readable storage medium storing instructions which, when executed by the processor, cause the processor to perform operations comprising:
• gathering data describing each file in a source code repository;
• generating, using a weighted algorithm based on empirical relationships between the data and customer-found defects, a risk score for each file in the source code repository, wherein:
• the empirical relationships are based on empirical data of previous actions taken to remediate risks;
• the weighted algorithm is adapted on a per-product basis based on at least one of a number of past changes associated with prior customer found defects, a number of change requests, or a number of authors who have left development;
• and
• the weighted algorithm comprises a×ln(nD)+b×ln(nAL)+c×ln(nSV)+d×ln(nSW), in which a, b, c and d are constants and nD represents a number of past changes, nAL represents a number of authors who have left development, nSV represents a number of change requests, and nSW represents a number of static analysis warnings;
• generating a list of files having risk scores above a threshold;
• and
• making a risk-mitigation recommendation for each file in the list based on the risk score.

A non-transitory computer-readable storage device storing instructions which, when executed by a computing device, cause the computing device to perform operations comprising:

• gathering data describing each file in a source code repository;
• generating, using a weighted algorithm based on empirical relationships between the data and customer-found defects, a risk score for each file in the source code repository, wherein:
• the empirical relationships are based on empirical data of previous actions taken to remediate risks;
• the weighted algorithm is adapted on a per-product basis based on at least one of a number of past changes associated with prior customer found defects, a number of change requests, or a number of authors who have left development;
• and
• the weighted algorithm comprises a×ln(nD)+b×ln(nAL)+c×ln(nSV)+d×ln(nSW), in which a, b, c and d are constants and nD represents a number of past changes, nAL represents a number of authors who have left development, nSV represents a number of change requests, and nSW represents a number of static analysis warnings prioritizes factors based on predictiveness of defects;
• generating a list of files having risk scores above a threshold;
• and
• making a risk-mitigation recommendation for each file in the list based on the risk score.