No abstract

No abstract

No abstract

Eu dedico esta tese à minha esposa, à minha mãe, ao meu pai e ao meu irmão. First, I would like to thank Paulo for his dedication and patience during the last years. Not only for his Ph.D. supervision, but also for many valuable pieces of advice for my professional life. I take him as a model to be followed. I also want to thank my family support across these tough years. Especially my wife who wants more than me that this Ph.D. is over.

Summary In collaborative software development, developers submit their contributions to repositories that are used to integrate code from various collaborators. To avoid privacy and security issues, code contributions are often reviewed before integration. Although careful manual code review can detect such issues, it might be time‐consuming, expensive, and error‐prone. Automatic analysis tools can also detect privacy and security issues, but they often demand significant developer effort, or are domain specific, considering fixed framework specific vulnerability sources and sinks. To reduce these problems, in this paper we propose the Salvum policy language to support the specification of constraints that help to protect sensitive information from being inadvertently accessed by specific code contributions. We implement a tool that automatically checks Salvum policies for systems of different technical domains. We also investigate whether Salvum can find policy violations for a number of open‐source projects. We find evidence that Salvum helps to detect violations even for well‐supported and highly active projects. Moreover, our tool helps to find 80 violations in benchmark projects.