A method is used in managing security of source code. Source code characteristics are derived from a source code change. Based on the source code characteristics, risk information associated with the source code change is produced.