Automatic extraction of sensitive code fragments to be executed in a sandbox

According to an aspect of some embodiments of the present invention there is provided a computer implemented method of refactoring a source code that includes a plurality of references to sensitive data into at least two separate source codes, comprising receiving a source code comprising a plurality of references to sensitive data, identifying a plurality of code blocks comprising the plurality of references, refactoring the source code into an enterprise source code having a plurality of functions containing the plurality of code blocks and a cloud source code that is semantically equivalent when executed to the source code when executed, and replacing within the cloud source code at least one of the plurality of code blocks with a call to a function within the enterprise source code, the function containing a code block that is semantically identical to the replaced code block.