Microsoft bolstered its GitHub operations by acquiring software engineering analytics firm Semmle for an undisclosed amount. The move ties in a security component to the open source supply chain.

Semmle’s semantic code analysis engine allows developers and security teams to discover and track potential vulnerabilities in their code. They can then tag those concerns to that code that is distributed into the open source community. That platform has identified thousands of vulnerabilities, including 107 Common Vulnerabilities and Exposures (CVEs) in open source projects. The company works with a number of large organizations, including NASA, Uber, Google, and, coincidently, Microsoft.

“Security researchers use Semmle to quickly find vulnerabilities in code with simple declarative queries,” explained GitHub CEO Nat Friedman, in a blog post on the deal. “These teams then share their queries with the Semmle community to improve the safety of code in other codebases.”

Securing open source code is a growing concern as that code is becoming core to a larger number of software platforms. The Cloud Native Computing Foundation (CNCF) recently released results of a security check of its flagship Kubernetes project that found 37 vulnerability issues, including five high-severity issues and 17 medium-severity issues.

Semmle had raised $31 million through a trio of funding rounds since its founding in 2006. Its most recent – and lucrative – was just over a year ago when it scored $21 million. Company co-founder and CEO Oege do Moor, said the company had doubled its customer base and increased open source usage by 10x over the past year.

The deal also continues Microsoft’s ongoing reinforcement of its GitHub operations. The cloud and software giant purchased GitHub last year for $7.5 billion and has been active in supporting expansion of its operations.

Most recently, GitHub integrated a much sought-after continuous integration/continuous development (CI/CD) tool into its Actions product that expands its ability to serve broader needs of the developer community and could alter the market’s competitive landscape.

Thomas Murphy, senior director analyst at Gartner, told SDxCentral at that time that the move was a strong push by the company.

“GitHub needs to continue to evolve and grow, and this is part of that process,” Murphy told SDxCentral. “They need to do that in ways that are part of the Microsoft relationship and also to still be independent of that relationship.”

While Microsoft did not put a financial number to the Semmle deal, it did announce plans to spend up to $40 billion buying back its common stock. Microsoft’s stock surged more than 2% early Thursday on the news, setting a new 52-week high of $142.37 per share.

The Wall Street Journal noted that this was the third such buyback program of that size by the company. Microsoft did not put a timeline on the purchase plan, but did note that it could terminate the offer at any point.