devopsy.kinsta.cloud

Tag: code analysis

Sonar Adds Ability to Analyze Architecture of Applications to Code Analysis Tool

Sonar this week revealed it has added an ability to analyze the architecture of a software application to its SonarQube tool for analyzing code quality.

Available in beta and scheduled to be made generally available in the first quarter, the addition to SonarQube promises to make it simpler to understand the actual structure of an application versus what might have been initially intended.

Sonar chairman and founder Olivier Gaudin said that capability plays a critical role in preventing applications from potentially crashing as changes are made over time. In fact, the less attention that is paid to best architecture practices the greater the odds become that the amount of time and effort required to add new capabilities to an application will increase, noted Gaudin.

The ultimate goal is to reduce the likelihood that an application might one day have to be entirely rewritten as changes that deviated from the original architectural plan take their toll in the form of technical debt that eventually needs to be addressed, he added.

In effect, SonarQube is now able to reverse engineer an application by analyzing the code used to construct it. DevOps teams can then use those insights to define a structure for new and existing components, including the relationships between components, to create a blueprint for developers to follow while coding. SonarQube then performs automated reviews against your established architectural blueprint to surface gaps and deviations that can be addressed within the context of a DevOps workflow, said Gaudin.

It’s not clear how often organizations are rewriting applications because they have evolved in a way that proves unsustainable, but as application development teams rely more on artificial intelligence (AI) tools to write code it becomes more probable these types of issues will be encountered, noted Gaudin.

On the plus side, the ability to analyze architecture should make it easier for AI agents to more accurately assess applications in a way that ultimately serves to improve quality, he added. Longer term, the goal is to enable AI tools to automatically remediate issues that arise as developers are writing code, noted Gaudin

In the meantime, however, the number of architecture-related issues that DevOps teams are going to encounter is only going to increase as, for example, developers embrace so-called vibecoding tools to generate application code, he added.

Previously, Sonar has made available training tools to providers of large language models (LLMs) that are designed to help reduce the number of security vulnerabilities and bugs that might be generated, but it might be a while yet before the impact of the tools is seen in the output of the code being generated. For now, the quality of the code being generated by LLMs will continue to vary widely depending on the LLM being invoked.

DevOps teams, as a result, would be well-advised to double down on code reviews today that, all too often in the past in the name of expediency, were not always rigorously conducted as they should have been as application developers strove to add new capabilities to applications as quickly as possible no matter what the real ultimate cost might be.

December 18, 2025
How to Analyze Your Code for Security Vulnerabilities

Shifting Left 2.0 is a two-day virtual conference taking place from 9 a.m. to 2 p.m. PDT on June 22nd-23rd that dives deep into application security in the modern tech space. Security experts share insights on topics ranging from how to measure AppSec success to what role AppSec plays in digital transformation. Software developers, security engineers, C-level business leaders and more can all benefit from the lively tech conversations at this free virtual experience.

Vickie Li, developer evangelist at ShiftLeft, teases her session at Shifting Left 2.0 in the Q&A below. Vickie and Suchakra Sharma, staff scientist at ShiftLeft, describe how to effectively review code for vulnerabilities and present tactics for performing an effective security code review on your applications on Wednesday, June 23rd from 10:10 a.m. to 10:40 a.m. PDT.

You can find the full agenda and register for free at Shifting Left 2.0.

To start off, why don’t you tell me a little bit about your role as a developer evangelist at ShiftLeft?

My job as a developer evangelist is to help developers write more secure code. Here at ShiftLeft, we build and support ShiftLeft CORE, a security tool that helps developers find vulnerabilities in their code through SAST, SCA, and secret scanning. But a big component that goes into building secure software is to understand and remediate the vulnerabilities found by these tools. My goal is to help developers build more secure applications by learning the security fundamentals they need to write secure code and use security tools effectively.

Your session is titled, “Intro to Code Analysis,” so I am curious what are some of the most effective ways to analyze your code for security vulnerabilities?

I am probably giving away a bit of a spoiler here for my session with Suchakra. The most effective way of finding vulnerabilities in code is to use static code analysis, or to find security issues by analyzing source code. Techniques like dynamic analysis and penetration testing excel at finding exploitable vulnerabilities but often miss a large number of security issues. Static analysis, on the other hand, tends to be much better at finding as many vulnerabilities as possible.

But conducting a manual code analysis on every single line of code is inefficient and not feasible in most cases. In this case, utilizing a SAST tool to scan the application and then validating the results afterward using manual code review would be the best action plan.

Code is really at the heart of building secure applications. With that in mind, how beneficial is it for developers to have a security mindset when writing code?

It is extremely crucial for developers to keep security in mind when building software. Security is a team effort by everyone: application security engineers, system administrators, managers, architects, and analysts. But when dealing with application security, developers are the ones who write vulnerabilities into code, and developers are the ones who have to fix vulnerabilities when they are found. So as developers, if we can keep security in mind during the development process, we can prevent vulnerabilities from being introduced into the code base, saving ourselves and our colleagues time and headache down the line.

What type of security training or continuous learning practices should dev teams implement to help secure the code they write?

Learning about security continuously is key to building secure applications. Developer security education needs to be efficient, engaging, and easy to absorb, and we need to introduce security training in a way that is relevant to everyday development work. By identifying security issues in a developer’s code, we can provide the context of the security issue and demonstrate the real-life importance of best practices.

June 16, 2021
MuseDev Offers DevOps-Optimized Security Code Analyzer

MuseDev today announced it has made available on GitHub under an early access program a code analysis tool dubbed Muse that is designed to surface cybersecurity issues as pull requests are made from the repository.

Company CEO Stephen Magill said rather than waiting to discover cybersecurity issues after an application is deployed, Muse makes it easier for IT teams to consistently employ best DevSecOps practices.

There’s general agreement DevOps teams should assume more responsibility for application security as part of any quality assurance process. However, DevOps teams have lacked access to tools that would make it easier to incorporate security analytics within the context of existing application development and deployment workflows, said Magill.

Muse is also designed to surface cybersecurity issues in a way that makes it easier for developers to comprehend, said Magill. MuseBot automatically analyzes each pull request and delivers bug reports in GitHub as code review comments. In contrast, he noted, code analysis tools employed by cybersecurity teams tend to surface lists of vulnerabilities without providing developers with enough context to remediate or even prioritize.

Muse is also designed to provide a faster alternative that generates results in about 20 minutes, which means DevOps teams can address issues within a workflow versus waiting for a report from a cybersecurity team, noted Magill.

Too often code analysis tools will also generate too many false positives, he said. Muse includes a broad set of tools such as ErrorProne, Infer and Pyre for various cloud platforms that are customized and configured to reduce alert noise. Muse also provides access to an open application programming interface (API) that makes the platform fully customizable, Magill added.

Muse is available as a GitHub app that the company is promising will be free always for open source projects and other public GitHub repositories. Analysis of private repositories is also available at no cost. A self-hosted Enterprise version available for GitHub, Bitbucket and GitLab, scheduled to be generally available by the end of the year, is also available as a private beta. MuseDev is also making available a professional services team to help organizations implement the platform.

The company itself was spun out of Galois, a research and development firm that specializes in cybersecurity.

In general, it can cost organizations as much as 10 times more after an application is deployed in a production environment to address cybersecurity issues. Despite widespread awareness of that issue, adoption of best DevSecOps practices within many organizations remains relatively nascent. There’s a lot of interest in DevSecOps as a goal, but few organizations have been able to put the tools that are needed to construct security workflows into the hands of DevOps teams.

However, as more DevSecOps tools become available, chances are a lot of progress soon will be driven from the bottom up in most organizations rather than from the top down.

July 30, 2020
OverOps Partners With GitLab to Analyze Code Earlier

OverOps has allied with GitLab to integrate a tool that analyzes code at runtime to identify issues with a continuous integration/continuous delivery (CI/CD) platform.

Eric Mizell, vice president of solution engineering for OverOps, said the plugin for the GitLab CI/CD will make it easier to surface issues with code earlier in the DevOps pipeline. OverOps’ quality gates help determine if code is safe to promote and automatically blocks unstable releases from moving forward to production.

OverOps combines static and dynamic analysis of code as it executes by relying on machine learning algorithms to collect data. That analysis can be accessed either via dashboards based on open source project Grafana software or shared with other tools via an open application programming interface (API). It analyzes code at runtime to identify all new, increasing, resurfaced and critical errors in a release. OverOps then generates a code quality report that ranks issues in terms of potential to impact end users and application functionality.

According to a recent survey of more than 600 software development and delivery professionals conducted by OverOps, more than 50% of respondents spend a day or more per week troubleshooting code-related issues.

The survey also finds that nearly 25% of organizations experience critical/customer-impacting production issues on a daily or weekly basis.

The earlier code issues are detected the less expensive they are to fix. OverOps is making the case for making its tool part of the quality assurance gate within any CI/CD pipeline.

The paradox many organizations find themselves in is that as DevOps processes enable them to build and deploy applications they wind up spending a lot more time debugging those applications.

Eventually, developers wind up spending more time fixing existing application code than developing new applications. Tools such as OverOps are employing machine learning algorithms to reduce the amount of time spent discovering code issues, which should free up more time to write new code.

OverOps captures machine data about every error and exception at the moment it occurs, including details such as the value of all variables across the execution stack, the frequency and failure rate of each error, the classification of new and reintroduced errors and the associated release numbers for each event.

DevOps teams historically rely on log data to manually search for anomalies indicative of issues with code. Not only is OverOps faster, but the algorithms will also surface uncaught and swallowed exceptions that would otherwise be unavailable in log files.

There are a lot of aspects of DevOps that now can be better handled by machines than humans. That doesn’t mean humans will be replaced anytime soon. However, the bulk of time-consuming and monotonous DevOps tasks that exist today are eventually going to be performed by a machine faster and with greater precision. The challenge and opportunity now are identifying the tasks where machine learning algorithms can have the most impact sooner than later.

July 17, 2020