Patent ID: 11966462
Assignee: DROPBOX, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. A method comprising:
identifying, by a computing system, a third-party dependency to be added to a codebase, the third-party dependency hosted on a third-party server;
downloading, by the computing system, the third-party dependency within a secure runtime environment;
generating, by the computing system, a signature value for the third-party dependency;
comparing, by the computing system, the signature value to a database of signature values of approved third-party dependencies;
upon determining, by the computing system, that the signature value does not correspond to any signature values of the approved third-party dependencies, executing the third-party dependency with a replica of the codebase within the secure runtime environment;
monitoring, by the computing system, the execution of the third-party dependency within the secure runtime environment to identify whether the third-party dependency violates a security rule;
upon determining, by the computing system, that the third-party dependency does not violate the security rule, adding the signature value to the database of signature values of approved third-party dependencies; and
after the third-party dependency has been determined not to exhibit suspicious activity and has been imported into the codebase:
executing, by the computing system, a service incorporating the third-party dependency on a runtime server, and
monitoring, by the computing system, behavior of the third-party dependency as incorporated in the service on the runtime server.