SonarQube + OpenAI: Agentic Development — Killian Carlsen-Phelan, Sonar

Class. Class. So, I'm from the So, I'm from the Codex Deployment Engineering team, and I Codex Deployment Engineering team, and I want to say a quick word want to say a quick word want to say a quick word to to to introduce the wonderful introduce the wonderful introduce the wonderful people at Sonar, as people at Sonar, as people at Sonar, as well as Killian. I'm going well as Killian. I'm going well as Killian. I'm going to skip some of the basics to skip some of the basics to skip some of the basics about agents that I about agents that I about agents that I usually talk about usually talk about usually talk about because I feel like this because I feel like this because I feel like this audience is knowledgeable audience is knowledgeable audience is knowledgeable about such things. We will about such things. We will about such things. We will immediately move on to more immediately move on to more immediately move on to more complex questions, complex questions, complex questions, such as what does completing a task mean such as what does completing a task mean such as what does completing a task mean for an agent for an agent for an agent ? ? ? What are trust boundaries? And What are trust boundaries? And What are trust boundaries? And we also want to we also want to we also want to present three present three present three rather sharp rather sharp rather sharp statements. First: " statements. First: " done" means that done" means that done" means that the task is complete with the task is complete with the task is complete with evidence. Second: evidence. Second: evidence. Second: restriction is not restriction is not restriction is not correctness. And third correctness. And third : the feedback contract : the feedback contract : the feedback contract must be must be must be inside the loop. So inside the loop. So , when we have an , when we have an , when we have an agent cycle, it usually agent cycle, it usually agent cycle, it usually follows a few follows a few follows a few predictable predictable predictable patterns. We patterns. We patterns. We usually have a model action usually have a model action . We have . We have . We have model-driven execution. model-driven execution. model-driven execution. We observe We observe We observe changes, whether they are logs, changes, whether they are logs, changes, whether they are logs, results, output, or results, output, or results, output, or something else. And we something else. And we something else. And we continue continue continue to update the plan. This is a kind of to update the plan. This is a kind of to update the plan. This is a kind of general general general agent cycle that we agent cycle that we agent cycle that we follow. And then follow. And then follow. And then with each individual with each individual with each individual task we have a task we have a task we have a result. We have result. We have result. We have invariants. We have a invariants. We have a invariants. We have a generally defined generally defined generally defined amount of work that we amount of work that we amount of work that we are working on. And are working on. And are working on. And of course, we also of course, we also of course, we also have have have eligibility criteria. So for eligibility criteria. So for eligibility criteria. So for us, the definition of " us, the definition of " done" is done" is done" is usually a diff that usually a diff that usually a diff that can be viewed, can be viewed, can be viewed, some some some instrumental instrumental instrumental evidence, that sort of thing. This evidence, that sort of thing. This evidence, that sort of thing. This doesn't just mean doesn't just mean doesn't just mean saying "fixed" saying "fixed" . This actually . This actually . This actually means saying " means saying " fixed" and providing fixed" and providing fixed" and providing evidence to evidence to evidence to support this support this support this fact. So, cheaper fact. So, cheaper fact. So, cheaper implementations usually implementations usually implementations usually shift the " shift the " shift the " bottleneck" to bottleneck" to bottleneck" to specification and

specification and specification and verification, which is verification, which is verification, which is not what we not what we not what we want at all. There is also want at all. There is also want at all. There is also the idea of ​​correlated the idea of ​​correlated the idea of ​​correlated failure. And there are usually failure. And there are usually failure. And there are usually a few common a few common a few common failure modes that failure modes that encoding agents tend to fall into. They often boil down They often boil down to an incomplete to an incomplete to an incomplete context, where a context, where a context, where a local fix local fix local fix violates certain violates certain violates certain global invariants global invariants that we have. Or even that we have. Or even that we have. Or even better: the generated better: the generated better: the generated test we test we test we run to run to run to verify the verify the verify the results simply results simply results simply propagates the same propagates the same propagates the same problems further. problems further. Self-criticism is useful, Self-criticism is useful, but it is not an independent but it is not an independent but it is not an independent oracle, and we often oracle, and we often oracle, and we often find that find that find that the results of the the results of the the results of the agent and the agent and the agent and the verifier are often verifier are often verifier are often orthogonal to each orthogonal to each orthogonal to each other. You can't other. You can't other. You can't determine whether a determine whether a determine whether a task is complete without task is complete without task is complete without looking at both looking at both looking at both parts of it. So you parts of it. So you parts of it. So you usually want to usually want to usually want to almost specifically almost specifically almost specifically look for refutable look for refutable look for refutable evidence of evidence of evidence of task completion. According to task completion. According to task completion. According to the compiler, is this the compiler, is this the compiler, is this done? According to done? According to done? According to the analysis of tests and so the analysis of tests and so the analysis of tests and so on, is this done? on, is this done? on, is this done? And you can't And you can't And you can't really replace really replace really replace human review in this human review in this human review in this whole cycle. The whole cycle. The next point next point I want to quickly I want to quickly I want to quickly discuss is: isolation discuss is: isolation discuss is: isolation does not equal does not equal does not equal correctness. We have a correctness. We have a correctness. We have a level of execution level of execution level of execution that usually that usually that usually determines what an determines what an determines what an agent can do, right agent can do, right agent can do, right ? What tools does ? What tools does ? What tools does he have, what does he he have, what does he he have, what does he have access to? What is have access to? What is have access to? What is the scope of his the scope of his the scope of his powers? What powers? What powers? What approvals does he approvals does he approvals does he need to take action? And need to take action? And need to take action? And then, along with this then, along with this then, along with this execution level, execution level, execution level, we have the we have the we have the artifact level, where the results artifact level, where the results artifact level, where the results are actually evaluated are actually evaluated are actually evaluated . Is

. Is . Is the result acceptable the result acceptable ? What tests were ? What tests were ? What tests were created? What analysis created? What analysis created? What analysis was performed? What was performed? What was performed? What policy is applied policy is applied ? What is even the intention ? What is even the intention ? What is even the intention behind this? behind this? A sandbox can A sandbox can restrict writing, but restrict writing, but restrict writing, but cannot prove that cannot prove that cannot prove that the request is safe. What I'm the request is safe. What I'm the request is safe. What I'm trying to say is that trying to say is that trying to say is that no oracle is no oracle is no oracle is proof, and that it's worth proof, and that it's worth proof, and that it's worth using using using multi-level multi-level multi-level controls with different controls with different controls with different limits. This is a kind of limits. This is a kind of limits. This is a kind of tiered protection, tiered protection, tiered protection, these multi-level these multi-level these multi-level fuses—that's the fuses—that's the fuses—that's the general idea. general idea. The best part about this is The best part about this is that you, as a human, that you, as a human, that you, as a human, own the intent, you own the intent, you own the intent, you handle the exceptions, handle the exceptions, handle the exceptions, and of course, and of course, and of course, you make the you make the you make the release decision. So, one release decision. So, one release decision. So, one last thing. last thing. last thing. We also usually recommend We also usually recommend We also usually recommend using a using a using a feedback contract feedback contract feedback contract . . . They usually come with They usually come with They usually come with skills, which skills, which skills, which are, of course, procedures for are, of course, procedures for are, of course, procedures for performing a performing a performing a specific task specific task . MCPs contain . MCPs contain . MCPs contain structured structured structured tools and tools and tools and contexts. And of course, contexts. And of course, contexts. And of course, we can we can we can provide provide provide lifecycle checks lifecycle checks lifecycle checks using using using hooks. This is also very hooks. This is also very hooks. This is also very useful for useful for useful for detecting detecting detecting hard-coded hard-coded hard-coded secrets or similar secrets or similar secrets or similar things. So with this you things. So with this you things. So with this you create a complete create a complete create a complete CI and human verification process CI and human verification process CI and human verification process . This, ultimately, . This, ultimately, . This, ultimately, should be the basis of the should be the basis of the should be the basis of the human role in this human role in this human role in this process. So, in process. So, in any case, when you any case, when you any case, when you create such an create such an create such an agent process, there are agent process, there are agent process, there are a few a few a few things to evaluate. What is the limit, things to evaluate. What is the limit, things to evaluate. What is the limit, for example? Can for example? Can for example? Can you, for example, you, for example, you, for example, intercept secrets intercept secrets intercept secrets before data is fed into the

before data is fed into the before data is fed into the model? How is the project model? How is the project model? How is the project justified? Do justified? Do justified? Do you have specific you have specific you have specific rules, rules, rules, locations, or locations, or locations, or vulnerability paths vulnerability paths vulnerability paths that you can provide? that you can provide? that you can provide? What is the scope of coverage? What is the scope of coverage? What is the scope of coverage? Do Do Do binding parameters correctly binding parameters correctly binding parameters correctly preserve behavior preserve behavior ? These are things that should be ? These are things that should be ? These are things that should be checked. And of course, checked. And of course, checked. And of course, you should constantly you should constantly you should constantly re- re- re- check. check. check. Argue that Argue that Argue that agents are not final agents are not final agents are not final states. So, states. So, anyway, enough anyway, enough anyway, enough chatter from me. chatter from me. chatter from me. If you want to If you want to If you want to make three points: make three points: make three points: done means done means done means the task is complete with the task is complete with the task is complete with evidence. Second, evidence. Second, isolation does not equal isolation does not equal isolation does not equal correctness. And third: the correctness. And third: the correctness. And third: the feedback loop feedback loop feedback loop needs to be needs to be needs to be inside the loop so that inside the loop so that inside the loop so that you can take full advantage of you can take full advantage of the capabilities the capabilities provided by your agents, provided by your agents, provided by your agents, such as Codex. Uh, such as Codex. Uh, such as Codex. Uh, Killian, let's Killian, let's Killian, let's complete this loop, complete this loop, complete this loop, okay? That's actually okay? That's actually okay? That's actually all from my side. So all from my side. So all from my side. So thank you very much for giving thank you very much for giving thank you very much for giving me the opportunity me the opportunity me the opportunity to make this introduction. to make this introduction.

Thank you. If you can If you can take a look at this, take a look at this, take a look at this, scan it, and scan it, and scan it, and go through the points, go through the points, go through the points, that would be very helpful. that would be very helpful. that would be very helpful. There are several prerequisites. Once again There are several prerequisites. Once again , I'm Kilian. I'm a developer content engineer at Sonar. So, So, thanks again to OpenAI and Tony for the thanks again to OpenAI and Tony for the thanks again to OpenAI and Tony for the quick introduction to quick introduction to quick introduction to all of this. Codex is a all of this. Codex is a all of this. Codex is a very powerful very powerful very powerful tool. I tool. I tool. I use it use it use it constantly. He constantly. He constantly. He helps me a lot. It has a helps me a lot. It has a helps me a lot. It has a fast CLI. It has a fast CLI. It has a fast CLI. It has a pretty smart pretty smart pretty smart sandbox system. And the sandbox system. And the sandbox system. And the hook system it hook system it hook system it has also has also has also integrates perfectly with integrates perfectly with integrates perfectly with tools tools like SonarQube, which I like SonarQube, which I like SonarQube, which I want to want to want to talk about today. So, talk about today. So, talk about today. So, preparing your preparing your preparing your team for agent team for agent team for agent development development development with SonarQube and with SonarQube and with SonarQube and OpenAI. The question I OpenAI. The question I OpenAI. The question I want to ask want to ask want to ask today is: How do we today is: How do we today is: How do we ensure that the code ensure that the code ensure that the code in the results in the results in the results generated by generated by generated by agents like Codex is agents like Codex is agents like Codex is validated? That he is validated? That he is validated? That he is safe. In Sonar, we safe. In Sonar, we safe. In Sonar, we introduced the idea of ​​an introduced the idea of ​​an introduced the idea of ​​an agent-driven agent-driven agent-driven development cycle. We conducted a development cycle. We conducted a development cycle. We conducted a study last study last study last year and interviewed over year and interviewed over year and interviewed over a thousand developers. And a thousand developers. And a thousand developers. And we found that 42% of we found that 42% of the code captured was the code captured was the code captured was either generated by either generated by or created with the or created with the help of artificial intelligence. But 96% of help of artificial intelligence. But 96% of developers don't developers don't developers don't trust it trust it trust it completely. Isn't that right? The completely. Isn't that right? The completely. Isn't that right? The vast majority of

vast majority of vast majority of people don't think, "Hey, people don't think, "Hey, people don't think, "Hey, this is safe at first this is safe at first this is safe at first glance." Less than glance." Less than glance." Less than half of them say they half of them say they fully fully fully review code review code review code before before before pushing it to the pushing it to the pushing it to the codebase. There is a codebase. There is a codebase. There is a certain contradiction here. certain contradiction here. certain contradiction here. Nobody trusts him Nobody trusts him . A large amount of . A large amount of . A large amount of untrusted code untrusted code untrusted code ends up in the ends up in the ends up in the codebase. The reason is codebase. The reason is codebase. The reason is that previously the that previously the that previously the bottleneck was bottleneck was bottleneck was code generation. Right code generation. Right ? How do we create what we ? How do we create what we ? How do we create what we are trying to do are trying to do are trying to do to achieve the desired to achieve the desired to achieve the desired outcome? How do we outcome? How do we outcome? How do we actually write the actually write the actually write the code for the program code for the program code for the program we are trying we are trying we are trying to create? With AI to create? With AI agents, this is agents, this is agents, this is mostly solved mostly solved : they either do it : they either do it : they either do it themselves or with the themselves or with the themselves or with the help of AI agents. help of AI agents. So, the bottleneck So, the bottleneck has shifted from has shifted from has shifted from code generation to code generation to code generation to code verification. code verification. code verification. True? We have a True? We have a True? We have a huge amount of huge amount of huge amount of generated code, generated code, generated code, but now it all but now it all but now it all comes down to human comes down to human comes down to human limitations: "How do I limitations: "How do I limitations: "How do I make sure this is make sure this is make sure this is safe?" What safe?" What safe?" What help and what help and what help and what tools can I tools can I tools can I get to get to get to make sure this make sure this make sure this doesn't destroy my doesn't destroy my doesn't destroy my codebase or my customers codebase or my customers codebase or my customers and create a bunch of and create a bunch of and create a bunch of serious problems.

serious problems. So, we have four So, we have four steps in ACDC, the agent- steps in ACDC, the agent- driven driven driven development cycle. One of them development cycle. One of them development cycle. One of them doesn't have to be from Sonar doesn't have to be from Sonar . This is a generation. This is . This is a generation. This is . This is a generation. This is whatever coding tool whatever coding tool you use, you use, Codex or whatever— Codex or whatever— this is the generation step. this is the generation step. this is the generation step. But Sonar is responsible for But Sonar is responsible for But Sonar is responsible for management, verification, management, verification, management, verification, and resolution. and resolution. and resolution. Governance is Governance is Governance is about providing the about providing the about providing the agent with the right agent with the right agent with the right context, including context, including context, including your your your project guidelines, any project guidelines, any project guidelines, any rules, or specific rules, or specific rules, or specific architecture, to architecture, to architecture, to ensure high- ensure high- ensure high- quality context before quality context before anything is built. We have found that anything is built. We have found that this reduces the overall this reduces the overall this reduces the overall cost of tokens. And on an cost of tokens. And on an enterprise scale, this enterprise scale, this means significant means significant means significant money savings in the money savings in the money savings in the long long long run. run. run. Verification—this is when, Verification—this is when, Verification—this is when, once an agent once an agent once an agent finishes creating finishes creating finishes creating a task you a task you a task you assigned them, we want assigned them, we want assigned them, we want to make sure there are no to make sure there are no issues. That is, issues. That is, no issues with no issues with no issues with security, code quality security, code quality , , , maintainability, etc. — none maintainability, etc. — none of this of this of this should make it into the should make it into the should make it into the production code. Then, production code. Then, production code. Then, the solution is “Okay, the solution is “Okay, the solution is “Okay, we found the problem.” we found the problem.” Right? It could Right? It could be a vulnerability to be a vulnerability to be a vulnerability to injections or something injections or something injections or something like that. We need to like that. We need to fix this quickly and as efficiently as possible so we fix this quickly and as efficiently as possible so we can have this kind of can have this kind of can have this kind of iterative iterative iterative coding system right here.

coding system right here. And the last slide And the last slide I'll show before I'll show before I'll show before we move on to the we move on to the we move on to the practical part practical part practical part is the concept of is the concept of is the concept of internal and internal and internal and external external external validation loops. The outer validation loops. The outer validation loops. The outer loop—this is your loop—this is your loop—this is your traditional CI system traditional CI system traditional CI system that you have set up, that you have set up, that you have set up, right? You write code, right? You write code, right? You write code, push it to push it to push it to GitHub, GitLab or another GitHub, GitLab or another GitHub, GitLab or another system, the pipeline system, the pipeline system, the pipeline starts, and something starts, and something starts, and something can go wrong. Your can go wrong. Your can go wrong. Your test, scan, or test, scan, or test, scan, or SonarQube might throw SonarQube might throw SonarQube might throw an error, then an error, then an error, then you go back to the IDE, you go back to the IDE, you go back to the IDE, try to try to try to fix it, fix it, fix it, submit again, and submit again, and submit again, and it doesn't work again. it doesn't work again. it doesn't work again. It has become the bane of It has become the bane of It has become the bane of my life, the my life, the my life, the bane of the lives of bane of the lives of bane of the lives of many developers many developers . Therefore, we want . Therefore, we want . Therefore, we want to save time to save time to save time by shifting the focus to by shifting the focus to by shifting the focus to the left to the the left to the the left to the inner loop, inner loop, inner loop, i.e. the i.e. the i.e. the development environment (IDE). That is, development environment (IDE). That is, development environment (IDE). That is, once we have once we have once we have finished generating finished generating finished generating the code, we want the code, we want the code, we want to check its to check its to check its correctness within the correctness within the correctness within the IDE without sending IDE without sending IDE without sending it further. This saves a lot of it further. This saves a lot of it further. This saves a lot of time. I time. I time. I mean, especially the mean, especially the mean, especially the ability to ability to ability to automatically automatically automatically check all of check all of check all of this; Time is money this; Time is money this; Time is money for businesses, and for businesses, and for businesses, and your engineers your engineers your engineers will also save on will also save on therapy bills therapy bills by eliminating this by eliminating this by eliminating this annoyance. So, annoyance. So, annoyance. So, okay. This is the last okay. This is the last okay. This is the last slide I want to slide I want to slide I want to focus on before I focus on before I focus on before I move on to the move on to the move on to the terminal. A few terminal. A few terminal. A few points I want points I want points I want to discuss before that: to discuss before that: to discuss before that: you'll see two you'll see two you'll see two tools that tools that tools that I'm going to talk about. Our I'm going to talk about. Our context tool, context tool, called " called " context context

context expansion," we'll expansion," we'll expansion," we'll use in the use in the use in the maintenance phase, and maintenance phase, and you'll see the agent analysis tool you'll see the agent analysis tool in the in the in the validation phase. We validation phase. We validation phase. We will return to them will return to them will return to them later. And another later. And another later. And another important conclusion that important conclusion that important conclusion that I want everyone to I want everyone to I want everyone to focus on: the bottleneck focus on: the bottleneck focus on: the bottleneck has shifted has shifted has shifted from code generation to from code generation to from code generation to code verification. Uh-huh. code verification. Uh-huh. Before we Before we begin, everyone begin, everyone begin, everyone should have should have should have Docker running, if possible Docker running, if possible Docker running, if possible on your computer. on your computer. on your computer. Just a quick Just a quick Just a quick thumbs thumbs thumbs up so I up so I up so I understand who was able to understand who was able to understand who was able to meet the meet the meet the previous requirements. previous requirements. previous requirements. Thumbs up Thumbs up Thumbs up if you have if you have if you have Docker running, you're ready to Docker running, you're ready to Docker running, you're ready to go, you can go, you can go, you can open a terminal and open a terminal and open a terminal and follow me. follow me. follow me. Perfectly. There are several. Perfectly. There are several. Perfectly. There are several. Ideally. Thank you. If Ideally. Thank you. If Ideally. Thank you. If not, then again, not, then again, not, then again, this repository is this repository is this repository is available. You can available. You can available. You can work on this at a work on this at a work on this at a time that is convenient for you. time that is convenient for you. time that is convenient for you. You will have all this You will have all this You will have all this information. So information. So information. So let me let me let me get out of here quickly. get out of here quickly. get out of here quickly. I have limited I have limited I have limited visibility, the top of visibility, the top of visibility, the top of the screen is cut off, but it the screen is cut off, but it the screen is cut off, but it should be fine.

should be fine. should be fine. OK. So, the first thing OK. So, the first thing OK. So, the first thing we'll do is we'll do is we'll do is run a script run a script run a script called apply sonar. This is called apply sonar. This is called apply sonar. This is just a repository just a repository just a repository that I cloned that I cloned that I cloned locally. To do this, locally. To do this, locally. To do this, you will need a bash you will need a bash terminal. So if you're terminal. So if you're terminal. So if you're on Windows, you can on Windows, you can on Windows, you can use Git Bash use Git Bash use Git Bash or something similar. So or something similar. So or something similar. So I'll enter this now. This is an I'll enter this now. This is an I'll enter this now. This is an application of sonar. OK. And this application of sonar. OK. And this application of sonar. OK. And this will do a few things. will do a few things. will do a few things. This is a personal This is a personal This is a personal tool that I tool that I tool that I created. This is not an created. This is not an created. This is not an official Sonar product official Sonar product . It's just a shortcut so . It's just a shortcut so . It's just a shortcut so we don't spend 10 we don't spend 10 we don't spend 10 minutes clicking around the minutes clicking around the minutes clicking around the interface or something interface or something interface or something like that. Let me like that. Let me like that. Let me make sure that everything is fine with Wi-Fi make sure that everything is fine with Wi-Fi make sure that everything is fine with Wi-Fi . Good. . Good. . Good. My computer is slowing down a bit here My computer is slowing down a bit here My computer is slowing down a bit here . . But this will create a But this will create a project for you in SonarQube Cloud. project for you in SonarQube Cloud. project for you in SonarQube Cloud. Will run the Will run the Will run the first scan for you. first scan for you. OK. You, and he OK. You, and he authorizes me. So, authorizes me. So, authorizes me. So, we'll just open a we'll just open a we'll just open a browser. This browser. This browser. This will install will install will install a few relevant a few relevant a few relevant SonarQube tools for you, SonarQube tools for you, SonarQube tools for you, such as our CLI and everything such as our CLI and everything such as our CLI and everything else we'll else we'll else we'll need to need to need to run our run our run our plugin with Code X on top of plugin with Code X on top of plugin with Code X on top of it. OK.

it. OK. Wait a minute, the Wait a minute, the Wi-Fi seems to be Wi-Fi seems to be Wi-Fi seems to be slow here, but slow here, but slow here, but that shouldn't be a that shouldn't be a that shouldn't be a big problem. big problem. So, it was So, it was successful. You will need to successful. You will need to successful. You will need to enter the name of the enter the name of the enter the name of the organization you organization you organization you want. The want. The want. The organization that was organization that was organization that was created for you created for you created for you when you registered your when you registered your when you registered your account. This account. This account. This will launch this, will launch this, will launch this, just to talk just to talk just to talk about the project. This is a about the project. This is a about the project. This is a tiny tiny tiny Python project, nothing complicated Python project, nothing complicated . There are about four . There are about four . There are about four files here, less than files here, less than files here, less than 200 lines in total, and I added 200 lines in total, and I added 200 lines in total, and I added four four four vulnerabilities there. Three of vulnerabilities there. Three of vulnerabilities there. Three of them are them are them are security vulnerabilities, and one is a security vulnerabilities, and one is a code "smell". And when code "smell". And when code "smell". And when this script finishes this script finishes this script finishes running, we'll go running, we'll go running, we'll go to the to the to the dashboard to dashboard to dashboard to make sure we can make sure we can make sure we can see everything. OK.

see everything. OK. Usually, I think Usually, I think a lot of people a lot of people a lot of people try to try to try to connect to connect to connect to this Wi-Fi. On my this Wi-Fi. On my this Wi-Fi. On my personal Wi-Fi, it personal Wi-Fi, it personal Wi-Fi, it never took never took never took more than a minute. So more than a minute. So more than a minute. So if you're following the if you're following the if you're following the process at home, don't process at home, don't process at home, don't think you'll have to think you'll have to wait that long. Oh. So, I... you know what? Maybe I you know what? Maybe I you know what? Maybe I forgot to export forgot to export forgot to export my token. my token. my token. There is one There is one There is one quick step in the repository. This should quick step in the repository. This should quick step in the repository. This should be in your shell be in your shell . I'll disconnect for . I'll disconnect for . I'll disconnect for a second so I don't have to a second so I don't have to a second so I don't have to show my show my show my Sonar token to a Sonar token to a Sonar token to a room full of people, and I'll be room full of people, and I'll be room full of people, and I'll be right back. right back. So, there So, there should be should be should be appropriate steps in the repository. You will appropriate steps in the repository. You will appropriate steps in the repository. You will need to need to need to go through the go through the go through the dashboard. It dashboard. It dashboard. It seems to be in the seems to be in the administration section in administration section in SonarCube Cloud. OK.

SonarCube Cloud. OK. Redisplay. OK. Redisplay. OK. So, this will start. A So, this will start. A So, this will start. A few more things few more things few more things I'd like to I'd like to I'd like to talk about. We talk about. We talk about. We will see the will see the will see the SQL injection issue that SQL injection issue that SQL injection issue that will appear. Okay, will appear. Okay, will appear. Okay, great. It seems like great. It seems like great. It seems like everything is working now. So, everything is working now. So, everything is working now. So, the system will go through the the system will go through the the system will go through the process and automatically process and automatically process and automatically create everything for me create everything for me create everything for me on the panel. The on the panel. The on the panel. The safety rating it will safety rating it will safety rating it will show will be E. This is the show will be E. This is the show will be E. This is the lowest level. We lowest level. We lowest level. We put some put some put some security issues in there, security issues in there, security issues in there, and SonarCube immediately and SonarCube immediately and SonarCube immediately detects them. He says, " detects them. He says, " Hey, that's not good." The Hey, that's not good." The next thing I'll next thing I'll delve into once delve into once delve into once this loads this loads is dissecting a few is dissecting a few is dissecting a few issues. One of them issues. One of them issues. One of them will be the OpenAI API key. will be the OpenAI API key. will be the OpenAI API key. Very relevant if Very relevant if Very relevant if people use people use people use Codex. I did it. It's Codex. I did it. It's Codex. I did it. It's actually right here actually right here actually right here in the codebase. Oops, someone in the codebase. Oops, someone in the codebase. Oops, someone forgot to use the ENV forgot to use the ENV file or pass this file or pass this file or pass this as a variable. Hmm, this as a variable. Hmm, this as a variable. Hmm, this happens all the time happens all the time . And it often happens that . And it often happens that . And it often happens that people accidentally people accidentally people accidentally send this into send this into send this into production code. Um, and production code. Um, and production code. Um, and the average time the average time the average time to remove a secret in a to remove a secret in a to remove a secret in a public public public repository repository repository is now 90 days. This is is now 90 days. This is is now 90 days. This is just madness.

just madness. just madness. That is, your token That is, your token That is, your token just lies there, just lies there, just lies there, available to the whole available to the whole available to the whole world, to all bots world, to all bots world, to all bots that can that can that can collect it within 90 collect it within 90 collect it within 90 days. We want days. We want to prevent this as much as possible, and to prevent this as much as possible, and we have we have we have several tools to do this. several tools to do this. Um, another problem Um, another problem I'm I'm I'm going to show you now is a going to show you now is a going to show you now is a vulnerability to SQL vulnerability to SQL injections. Um, and if injections. Um, and if injections. Um, and if any of you, as a any of you, as a any of you, as a security professional, security professional, security professional, were looking at this code, were looking at this code, were looking at this code, you might have noticed this. you might have noticed this. But, um, here in But, um, here in this database.py file, I'm this database.py file, I'm this database.py file, I'm passing the query passing the query passing the query directly to the F-line, directly to the F-line, directly to the F-line, which is executed which is executed which is executed by the cursor. So, by the cursor. So, by the cursor. So, the argument goes the argument goes the argument goes directly into the string. This is very directly into the string. This is very directly into the string. This is very bad news. bad news. Especially because this task search function takes an task search function takes an argument from sys.argv. This argument from sys.argv. This argument from sys.argv. This means that anyone means that anyone means that anyone who controls sys.argv can who controls sys.argv can who controls sys.argv can control your control your control your database. Isn't that right? This is database. Isn't that right? This is database. Isn't that right? This is really bad. SonarQube really bad. SonarQube really bad. SonarQube is able to detect this and is able to detect this and is able to detect this and let you know, "Hey, let you know, "Hey, let you know, "Hey, here's the data stream here's the data stream here's the data stream we detected." It we detected." It we detected." It uses uses uses symbolic execution symbolic execution symbolic execution and and and pollution analysis to pollution analysis to pollution analysis to identify identify identify data flow and track data flow and track data flow and track its movement through your its movement through your its movement through your application. Um, there are a few application. Um, there are a few application. Um, there are a few things we'll do things we'll do things we'll do once this is once this is once this is set up. One of set up. One of

set up. One of them is installing the them is installing the them is installing the SonarQube Code SonarQube Code SonarQube Code X marketplace. The other is connecting X marketplace. The other is connecting X marketplace. The other is connecting it to your it to your it to your project. And one more thing— project. And one more thing— make sure everything is make sure everything is make sure everything is connected in the plugin. connected in the plugin. So, everything is almost So, everything is almost ready here. Sorry for the ready here. Sorry for the ready here. Sorry for the short wait, short wait, short wait, friends. Um, and if you're friends. Um, and if you're friends. Um, and if you're running this yourself, running this yourself, running this yourself, hopefully it's already hopefully it's already hopefully it's already completed or completed or completed or almost completed. This will be almost completed. This will be almost completed. This will be over soon, over soon, over soon, but today I but today I but today I will focus on three will focus on three will focus on three tools: the tools: the secret discovery hook that we secret discovery hook that we offer. We also offer. We also offer. We also have an have an have an issue listing tool issue listing tool issue listing tool via Codex, which allows you via Codex, which allows you via Codex, which allows you to see all issues to see all issues to see all issues from SonarQube from SonarQube from SonarQube directly in the directly in the directly in the terminal. And the third terminal. And the third is the ability to is the ability to is the ability to find and find and find and fix problems fix problems fix problems from the list that we from the list that we from the list that we load into the load into the load into the plugin itself. Does plugin itself. Does plugin itself. Does anyone have any questions at anyone have any questions at anyone have any questions at this point? By the way, this point? By the way, this point? By the way, if you have any questions if you have any questions if you have any questions or if your or if your or if your setup isn't setup isn't setup isn't working, we have working, we have working, we have our awesome our awesome our awesome Sonar team there. They are now Sonar team there. They are now Sonar team there. They are now giving giving giving you a short, friendly wave. Um, if you a short, friendly wave. Um, if you a short, friendly wave. Um, if you raise your hand and you raise your hand and you raise your hand and encounter encounter any difficulties, any difficulties, any difficulties, they will happily they will happily they will happily come up, come up, come up, chat with you, chat with you, chat with you, and help you and help you and help you figure it all out. Good.

figure it all out. Good. The analysis is complete and I The analysis is complete and I can go to my can go to my can go to my control panel. control panel. I open it. As I I open it. As I said, this will be our said, this will be our said, this will be our SonarQube cloud dashboard, SonarQube cloud dashboard, SonarQube cloud dashboard, which shows all the which shows all the which shows all the issues detected in issues detected in issues detected in your project. And your project. And your project. And if you have any if you have any if you have any problems with Wi-Fi or installing problems with Wi-Fi or installing any prerequisites, any prerequisites, again, no problem. again, no problem. again, no problem. This repository, the QR This repository, the QR code of which you code of which you code of which you scanned, just scanned, just scanned, just reload it. reload it. This repository will be This repository will be available to you. available to you. Good. So, here is the Good. So, here is the control panel. I wo control panel. I wo control panel. I wo n't waste n't waste n't waste much time here. But we much time here. But we much time here. But we see that the see that the see that the safety rating is E. There are three safety rating is E. There are three safety rating is E. There are three security issues, out of a security issues, out of a security issues, out of a total of four.

total of four. If I click here, If I click here, we'll see the same we'll see the same we'll see the same OpenAI API key that was OpenAI API key that was OpenAI API key that was discovered; it's discovered; it's discovered; it's just here as just here as just here as plain text in the plain text in the plain text in the source code. And source code. And source code. And if I go if I go if I go back, the other thing back, the other thing back, the other thing I want to I want to I want to focus on is this focus on is this focus on is this SQL SQL injection vulnerability right here. This is what injection vulnerability right here. This is what injection vulnerability right here. This is what I was telling I was telling I was telling you about regarding sys.argv; it's you about regarding sys.argv; it's you about regarding sys.argv; it's data flow analysis data flow analysis data flow analysis that traces it from that traces it from that traces it from the source through various the source through various the source through various files and functions to the files and functions to the files and functions to the receiving point right receiving point right receiving point right here. Very, very here. Very, very here. Very, very useful. Good. useful. Good. I'm going back to I'm going back to the terminal. Let the terminal. Let the terminal. Let me go to my me go to my me go to my handy clipboard handy clipboard handy clipboard of commands of commands of commands that I have here. I that I have here. I that I have here. I will run the command codex will run the command codex will run the command codex plugin marketplace add. And this will plugin marketplace add. And this will plugin marketplace add. And this will just add the just add the just add the SonarQube marketplace SonarQube marketplace SonarQube marketplace here. And once that's here. And once that's here. And once that's done, we'll done, we'll done, we'll move on to the move on to the move on to the codex itself. We will see the codex itself. We will see the codex itself. We will see the available available available SonarQube plugin and be able to SonarQube plugin and be able to SonarQube plugin and be able to select it. So, select it. So, select it. So, wait a few wait a few wait a few seconds. Thank you all for your seconds. Thank you all for your seconds. Thank you all for your understanding as understanding as I experienced I experienced slight slight connection delays. Again connection delays. Again , in your , in your , in your normal normal normal Agilitic workflows, I'm Agilitic workflows, I'm Agilitic workflows, I'm sure things will sure things will sure things will move much

move much move much faster. Perfectly. I faster. Perfectly. I faster. Perfectly. I open the codex. Class. And open the codex. Class. And open the codex. Class. And I'll type in /plugins, and then I'll type in /plugins, and then I'll type in /plugins, and then just find SonarQube and just find SonarQube and just find SonarQube and install it. So, install it. So, install it. So, it's getting it's getting it's getting the marketplace, launching it, the marketplace, launching it, the marketplace, launching it, calling /plugins, and then calling /plugins, and then calling /plugins, and then entering SonarQube. And it is entering SonarQube. And it is entering SonarQube. And it is installed. I'm going to installed. I'm going to installed. I'm going to get out get out get out of here so it can of here so it can of here so it can reboot and reboot and reboot and so I can run a so I can run a so I can run a few more commands. Ahem. I few more commands. Ahem. I few more commands. Ahem. I will enter sonar. off login. This will enter sonar. off login. This will enter sonar. off login. This will simply perform will simply perform will simply perform CLI authentication. Um, CLI authentication. Um, CLI authentication. Um, that will allow us that will allow us that will allow us to use to use to use many of the features that many of the features that many of the features that this plugin is based on this plugin is based on this plugin is based on . After that, . After that, . After that, we will finally move on we will finally move on we will finally move on to the final to the final to the final stage of setup, stage of setup, stage of setup, namely integrating Sonar namely integrating Sonar namely integrating Sonar with Codex, once that is with Codex, once that is with Codex, once that is complete. Yes.

complete. Yes. complete. Yes. Allow this. Perfectly. Allow this. Perfectly. I hope it won't I hope it won't take too long. A take too long. A take too long. A few more seconds to few more seconds to few more seconds to refresh, and then we'll refresh, and then we'll refresh, and then we'll run the run the run the integration command from Codex. Oh, integration command from Codex. Oh, integration command from Codex. Oh, it looks like there are it looks like there are it looks like there are some more...Let's try this. some more...Let's try this. It seems that for some It seems that for some reason the Sonar token reason the Sonar token reason the Sonar token we exported is we exported is we exported is getting lost. OK. Sonar I'll getting lost. OK. Sonar I'll get back to get back to you soon.

you soon. Check if Check if you can see my screen again. you can see my screen again. Perfectly. I'll Perfectly. I'll open the clipboard now open the clipboard now open the clipboard now and put this back. and put this back. Good. So what exactly Good. So what exactly this will do—a few this will do—a few this will do—a few different things. This different things. This different things. This will provide you with an will provide you with an will provide you with an interceptor to interceptor to interceptor to detect secrets. detect secrets. detect secrets. This will give your This will give your This will give your agent the MD directive agent the MD directive agent the MD directive to use to use to use all of all of all of SonarQube's capabilities. And this will give you SonarQube's capabilities. And this will give you SonarQube's capabilities. And this will give you other skills and other skills and other skills and MCP configuration. MCP configuration. Perfectly. This will take a little longer Perfectly. This will take a little longer , and then everything , and then everything , and then everything will be fully will be fully will be fully wired up to wired up to wired up to use the use the use the SonarQube Codex plugin. Quick SonarQube Codex plugin. Quick SonarQube Codex plugin. Quick time check. Okay time check. Okay , we have to make it.

, we have to make it. So, for me, this will So, for me, this will install two install two install two additional things that additional things that additional things that some of you who are some of you who are some of you who are using a using a using a free account free account free account may not see. may not see. This is This is context expansion and context expansion and context expansion and agent analysis. agent analysis. Agent analysis is an Agent analysis is an interceptor that interceptor that interceptor that fires instantly fires instantly fires instantly after any after any after any edit edit edit made by an agent. made by an agent. So if you give So if you give it the task of it the task of it the task of creating or modifying creating or modifying creating or modifying a file, it a file, it a file, it will automatically run a server-side will automatically run a server-side will automatically run a server-side analysis of the written analysis of the written analysis of the written code. code. code. Context extension works like this: Context extension works like this: Context extension works like this: when Codex is about to when Codex is about to when Codex is about to do something, it do something, it do something, it provides it with provides it with provides it with relevant instructions, relevant instructions, relevant instructions, architectural data, and architectural data, and architectural data, and other such other such other such information. Okay, information. Okay, information. Okay, finally we're ready to finally we're ready to finally we're ready to go, friends. We go, friends. We go, friends. We added a few things. added a few things. added a few things. In particular, some In particular, some In particular, some interceptors. There interceptors. There interceptors. There are also a few new skills under the hood are also a few new skills under the hood are also a few new skills under the hood .

. . I'll quickly copy this now. I'll quickly copy this now. So, I open the Codex. So, I open the Codex. Trust all these Trust all these Trust all these interceptors. interceptors. interceptors. Thank you, sandbox. And Thank you, sandbox. And Thank you, sandbox. And now the MCP server is now the MCP server is now the MCP server is running along running along running along with SonarQube. Now I'll with SonarQube. Now I'll with SonarQube. Now I'll say, "Hey, can say, "Hey, can say, "Hey, can you commit you commit you commit using my using my using my token?" This is a token?" This is a token?" This is a fake secret fake secret fake secret that the plugin suggests that the plugin suggests that the plugin suggests you try right away. I you try right away. I you try right away. I will say: "Of course." So will say: "Of course." So will say: "Of course." So you can see right away that you can see right away that you can see right away that it was blocked. it was blocked. it was blocked. No classified No classified No classified data was included in the data was included in the data was included in the LLM context. Nothing LLM context. Nothing LLM context. Nothing is stored in is stored in is stored in any logs or anything any logs or anything any logs or anything like that. like that. like that. Also, if you Also, if you Also, if you ask it to read a ask it to read a ask it to read a file with a secret, it wo file with a secret, it wo file with a secret, it wo n't do it. This n't do it. This n't do it. This will be blocked. Codex will will be blocked. Codex will will be blocked. Codex will never see never see never see any of your any of your any of your secrets or anything secrets or anything secrets or anything else that gets else that gets else that gets into your context. This is into your context. This is into your context. This is extremely important. extremely important. extremely important. People do this People do this People do this all the time. We all all the time. We all all the time. We all know what to do. Yes know what to do. Yes .

. . I have one question. I have one question. I have one question. Mm. Mm. Mm. What is the probability What is the probability What is the probability that Codex will write a script that Codex will write a script that Codex will write a script to read... to read... to read... Write a script to Write a script to Write a script to read a file? read a file? read a file? Yes. Yes. Yes. So, it is possible. Uh, So, it is possible. Uh, So, it is possible. Uh, it mostly works it mostly works it mostly works when using when using when using tools, right? This is a tools, right? This is a tools, right? This is a hook that hook that hook that is called when a is called when a user user request is submitted to the request is submitted to the request is submitted to the tool. So if you tool. So if you tool. So if you bypass it, it's possible bypass it, it's possible that this hook won't that this hook won't that this hook won't work. But with work. But with work. But with normal normal normal use of Codex and use of Codex and use of Codex and its tools, as well its tools, as well its tools, as well as prompts, if as prompts, if as prompts, if you leave out any you leave out any you leave out any secrets in the query, it will secrets in the query, it will secrets in the query, it will detect it. Uh, it looks like detect it. Uh, it looks like detect it. Uh, it looks like we're having a little we're having a little we're having a little trouble with our internet trouble with our internet connection here. Uh, I'm going to connection here. Uh, I'm going to connection here. Uh, I'm going to quickly quickly quickly restart this MCP restart this MCP server now. So, the MCP server now. So, the MCP server will allow us server will allow us server will allow us to use to use to use the features for the features for the features for interaction between Codex and the interaction between Codex and the interaction between Codex and the SonarQube cloud dashboard SonarQube cloud dashboard that we saw earlier that we saw earlier . For example, if we . For example, if we . For example, if we said, "Hey, said, "Hey, said, "Hey, list all list all list all the problems in my the problems in my the problems in my project." He can project." He can project." He can retrieve it and retrieve it and retrieve it and give us give us give us information back. I'll just information back. I'll just information back. I'll just quickly quickly quickly get out of here and get out of here and get out of here and open it again. And I'll

open it again. And I'll open it again. And I'll start this SonarQube MCP server again start this SonarQube MCP server again start this SonarQube MCP server again . Yes. I . Yes. I . Yes. I apologize profusely. I have a apologize profusely. I have a apologize profusely. I have a hard time hearing you. hard time hearing you. hard time hearing you. Could you come Could you come Could you come closer or speak closer or speak closer or speak a little louder? Mm. a little louder? Mm. Yes. Mm. Running this Yes. Mm. Running this myself via the myself via the myself via the ` apply sonar` script that ` apply sonar` script that ` apply sonar` script that sets everything up sets everything up sets everything up never takes never takes never takes more than a minute if more than a minute if more than a minute if I do it myself. Well, I do it myself. Well, I do it myself. Well, everything else in MCP lasts everything else in MCP lasts everything else in MCP lasts about the same as about the same as about the same as in other MCPs, in other MCPs, in other MCPs, provided the provided the provided the connection is normal. Uh, I do my connection is normal. Uh, I do my connection is normal. Uh, I do my best to best to best to work with the work with the work with the available connection, but available connection, but available connection, but other than that, I would say other than that, I would say there is no there is no there is no additional overhead additional overhead additional overhead that these tools that these tools that these tools add to a add to a developer's normal workflow. I'll developer's normal workflow. I'll quickly quickly quickly check if MCP is

check if MCP is check if MCP is up and running now up and running now up and running now . And as I said, . And as I said, . And as I said, MCP allows you to MCP allows you to MCP allows you to access all the access all the access all the tools, so tools, so tools, so whenever you whenever you whenever you ask it to do ask it to do ask it to do something related to Sonar, something related to Sonar, something related to Sonar, like like like review issues review issues review issues in your project, it in your project, it in your project, it automatically detects automatically detects automatically detects what's going on and what's going on and what's going on and can call can call any of those appropriate any of those appropriate any of those appropriate functions. One such functions. One such functions. One such function is function is function is context addition context addition , that is, understanding what , that is, understanding what , that is, understanding what "Okay" means. We "Okay" means. We "Okay" means. We have SonarQube tools, have SonarQube tools, have SonarQube tools, but our network but our network but our network doesn't seem to be providing doesn't seem to be providing doesn't seem to be providing any data about them to MCP. any data about them to MCP. Let me Let me try to see if try to see if try to see if it works after all it works after all . Let me say: " . Let me say: " List the List the List the problems in my problems in my problems in my project." Are there project." Are there project." Are there any other questions at any other questions at any other questions at this point? I think I this point? I think I this point? I think I could answer a could answer a could answer a few while we few while we few while we wait. Yes. wait. Yes. wait. Yes. Can you explain Can you explain how MCP interacts with the how MCP interacts with the Sonar command line interface (CLI)?

Yes, the CLI is really just Yes, the CLI is really just setting up setting up setting up the configuration. MCP the configuration. MCP the configuration. MCP runs inside Docker. runs inside Docker. So it sometimes So it sometimes uses MCP if uses MCP if uses MCP if one of its one of its one of its features is involved, but features is involved, but features is involved, but for the most part this for the most part this for the most part this plugin and everything else plugin and everything else plugin and everything else just sets up just sets up just sets up the configuration and then the configuration and then the configuration and then calls the calls the calls the required functions through it. The CLI required functions through it. The CLI required functions through it. The CLI helps you helps you helps you prepare and prepare and prepare and configure the MCP and all that stuff configure the MCP and all that stuff configure the MCP and all that stuff . And then there are the . And then there are the . And then there are the commands you commands you commands you can invoke can invoke can invoke through the MCP using the through the MCP using the through the MCP using the CLI. And I want to clarify the CLI. And I want to clarify the CLI. And I want to clarify the difference. There is a CLI that difference. There is a CLI that difference. There is a CLI that powers this powers this powers this plugin. So there are certain plugin. So there are certain plugin. So there are certain things that you things that you things that you can say, "Hey, can say, "Hey, can say, "Hey, do this task do this task do this task for me." And it can for me." And it can for me." And it can direct this through the direct this through the direct this through the MCP feature or through a MCP feature or through a MCP feature or through a CLI command. OK. CLI command. OK. CLI command. OK. So, it looks like we have an MCP. So, it looks like we have an MCP. So, it looks like we have an MCP. It runs very It runs very It runs very slowly over slowly over slowly over the network, but was able to the network, but was able to the network, but was able to detect it for us. So detect it for us. So detect it for us. So our issue list feature our issue list feature our issue list feature , as well as this , as well as this context addition feature, are working.

We also see that We also see that even when he's even when he's even when he's reviewing his reviewing his reviewing his functions, we're functions, we're functions, we're running a running a running a secrets scan, secrets scan, secrets scan, making sure that making sure that making sure that no API keys or no API keys or no API keys or anything like that are being anything like that are being anything like that are being leaked when he's leaked when he's leaked when he's reviewing any of reviewing any of reviewing any of his files, including the his files, including the his files, including the files of the files of the files of the functions themselves. Okay. We are functions themselves. Okay. We are functions themselves. Okay. We are valid. He valid. He valid. He looks through them all. And looks through them all. And looks through them all. And again, again, again, there are problems with there are problems with network connectivity. In a normal network connectivity. In a normal agent agent agent workflow, all of this should workflow, all of this should workflow, all of this should happen much happen much happen much faster. Are there any more faster. Are there any more faster. Are there any more questions while we questions while we questions while we wait for it wait for it wait for it to load a bit? to load a bit? Is Is corporate server supported corporate server supported ? Yes, definitely. This is ? Yes, definitely. This is ? Yes, definitely. This is available at available at any level of any level of any level of SonarQube usage, SonarQube usage, SonarQube usage, be it cloud, server, be it cloud, server, be it cloud, server, enterprise, or free enterprise, or free enterprise, or free version. Um, everyone version. Um, everyone version. Um, everyone should have access to this should have access to this should have access to this . But the limitation . But the limitation . But the limitation is that is that is that context augmentation context augmentation context augmentation and agent analysis and agent analysis are two tools are two tools are two tools that we don't offer that we don't offer that we don't offer in the free in the free in the free version. Um, but if version. Um, but if version. Um, but if your organization has the your organization has the your organization has the appropriate appropriate appropriate access rights, you will be able access rights, you will be able access rights, you will be able to use these to use these to use these tools. Good.

tools. Good. So, we saw that So, we saw that we could get the we could get the we could get the same issues we same issues we same issues we saw on the dashboard saw on the dashboard saw on the dashboard now available in the CLI. now available in the CLI. Imagine that it took Imagine that it took 15 seconds and that the engineer 15 seconds and that the engineer 15 seconds and that the engineer has a stable Wi-Fi has a stable Wi-Fi has a stable Wi-Fi connection. Um, they'll connection. Um, they'll connection. Um, they'll get it very get it very get it very quickly in their IDE. quickly in their IDE. Here's the secret Here's the secret locked level item locked level item I mentioned I mentioned earlier, but the one earlier, but the one earlier, but the one I want to highlight and I want to highlight and I want to highlight and fix today fix today fix today is S8702. This is a rule is S8702. This is a rule is S8702. This is a rule we wrote we wrote we wrote specifically for specifically for specifically for workflows with AI workflows with AI agents. We don't agents. We don't agents. We don't want AI agents want AI agents want AI agents to write code that other to write code that other to write code that other agents can agents can agents can exploit. This is the exploit. This is the exploit. This is the sys.argv I sys.argv I sys.argv I talked about a little talked about a little talked about a little earlier. Again, earlier. Again, earlier. Again, anyone with anyone with anyone with access to sys.argv will be able to access to sys.argv will be able to access to sys.argv will be able to gain control gain control gain control of your database of your database . We want . We want . We want to prevent this. So I'll to prevent this. So I'll to prevent this. So I'll just say to Codex, "Hey just say to Codex, "Hey , fix S8702." This , fix S8702." This , fix S8702." This will start. And again will start. And again will start. And again , you can , you can , you can instantly pull instantly pull instantly pull all these issues into all these issues into all these issues into your terminal and your terminal and your terminal and ask Codex ask Codex ask Codex to fix them. It will be a little to fix them. It will be a little to fix them. It will be a little different on my different on my different on my machine compared to those machine compared to those machine compared to those following following following me: as you will see, me: as you will see, me: as you will see, once the code is once the code is once the code is edited and edited and edited and changed here, the

changed here, the changed here, the hook will be triggered hook will be triggered hook will be triggered after using the after using the agent analysis tool. It does the following: It does the following: if if any any new vulnerabilities have emerged during the patching process, new vulnerabilities have emerged during the patching process, new vulnerabilities have emerged during the patching process, SonarQube will scan for it on the SonarQube will scan for it on the SonarQube will scan for it on the server side. If server side. If server side. If you don't have agent you don't have agent you don't have agent analysis, that's perfectly analysis, that's perfectly analysis, that's perfectly fine. You can fine. You can fine. You can just scan just scan just scan your code during the your code during the your code during the next CI push or next CI push or next CI push or something like that, but something like that, but , um, , um, , um, it will be checked anyway. it will be checked anyway. Using Using agent analysis agent analysis agent analysis simply closes that simply closes that simply closes that loop and provides loop and provides loop and provides automatic automatic automatic feedback feedback feedback so you know, "Hey, I so you know, "Hey, I so you know, "Hey, I didn't add any new didn't add any new didn't add any new problems." Um, I don't know problems." Um, I don't know problems." Um, I don't know about you, but I've sometimes been about you, but I've sometimes been about you, but I've sometimes been in in in programming sessions where I've been like, programming sessions where I've been like, programming sessions where I've been like, "Hey, fix this "Hey, fix this "Hey, fix this problem." And then problem." And then problem." And then three more appear, and three more appear, and three more appear, and I try to I try to I try to fix them, and it's like fix them, and it's like fix them, and it's like fighting a hydra, where fighting a hydra, where fighting a hydra, where they just they just they just multiply. multiply. Using this Using this automatically automatically automatically confirms that you are not confirms that you are not confirms that you are not creating any creating any creating any new vulnerabilities. new vulnerabilities.

Perfectly. So, we Perfectly. So, we were able to fix it. were able to fix it. were able to fix it. We receive a We receive a We receive a parameterized parameterized parameterized query. Perfectly. Um, and query. Perfectly. Um, and query. Perfectly. Um, and this hook completes after this hook completes after this hook completes after using the using the using the tool tool tool . It . It . It tells you that there tells you that there tells you that there is a problem with the file. is a problem with the file. However, it existed However, it existed before. This was one of the before. This was one of the before. This was one of the problems I had already problems I had already problems I had already added added added here in advance. So it won't here in advance. So it won't here in advance. So it won't try try try to resolve everything else in to resolve everything else in to resolve everything else in your file. He's your file. He's your file. He's smart and just smart and just smart and just realizes, "Hey, whatever realizes, "Hey, whatever realizes, "Hey, whatever was in the changed was in the changed was in the changed code, we'll code, we'll code, we'll analyze it and analyze it and analyze it and make sure that this make sure that this make sure that this code didn't create new code didn't create new code didn't create new problems." So great. problems." So great. Um, he Um, he re-analyzed this re-analyzed this re-analyzed this code and confirmed that code and confirmed that code and confirmed that it passed the it passed the it passed the test. Um, and we're test. Um, and we're test. Um, and we're not not not reporting on SA702 anymore. reporting on SA702 anymore. So, we can So, we can find, find, find, fix, and fix, and fix, and automatically automatically automatically check new code check new code check new code as soon as it as soon as it as soon as it appears in our appears in our appears in our workspace. workspace.

OK. I want to OK. I want to leave some time leave some time leave some time for questions for questions for questions at the end, so I'll at the end, so I'll at the end, so I'll just skip to the just skip to the just skip to the last part. This is last part. This is last part. This is adding a new adding a new adding a new feature. Right? feature. Right? feature. Right? Delete tasks by Delete tasks by Delete tasks by ID in the database.py file. And ID in the database.py file. And ID in the database.py file. And when we ask it when we ask it when we ask it to generate new code, to generate new code, to generate new code, it it it will use will use will use context completion context completion . As I mentioned . As I mentioned . As I mentioned earlier, this gets the earlier, this gets the earlier, this gets the relevant relevant architecture context rules from your architecture context rules from your project and feeds them to project and feeds them to project and feeds them to the agent. I don't know the agent. I don't know the agent. I don't know how long this might how long this might how long this might take. I think less take. I think less take. I think less than a few minutes. than a few minutes. This usually takes This usually takes seconds. Um, but I seconds. Um, but I seconds. Um, but I also want you to also want you to also want you to understand that understand that understand that using this using this is a complete loop in the is a complete loop in the is a complete loop in the terminal. While we're terminal. While we're terminal. While we're running the agent—oh, running the agent—oh, running the agent—oh, look, he look, he look, he finished really quickly. finished really quickly. finished really quickly. Very well done. Very well done. Um, as we Um, as we get the get the get the appropriate context appropriate context , we fix it or , we fix it or , we fix it or implement it—in implement it—in implement it—in this case, when this case, when this case, when we ask it we ask it we ask it to implement a new to implement a new to implement a new feature. It feature. It feature. It is checked using an is checked using an agentive agentive analytical hook. And analytical hook. And analytical hook. And if there were any if there were any if there were any issues there, they would be issues there, they would be issues there, they would be flagged, and Codex flagged, and Codex flagged, and Codex would continue to would continue to would continue to iterate until everything iterate until everything iterate until everything was fixed. This is was fixed. This is was fixed. This is how we get to the how we get to the how we get to the “ “ manage, test, manage, test, manage, test, and decide” methodology.

and decide” methodology. OK. I won't OK. I won't waste any more time in the waste any more time in the waste any more time in the terminal. Um, this is terminal. Um, this is terminal. Um, this is again available again available again available for you to for you to for you to work with in your work with in your work with in your free time. Um, there are a free time. Um, there are a free time. Um, there are a few more things few more things few more things you can do there, you can do there, you can do there, like like like try to find try to find try to find some of the some of the some of the remaining problems. Um, if remaining problems. Um, if remaining problems. Um, if your organization has the your organization has the your organization has the right to right to right to context augmentation and context augmentation and context augmentation and agentive analysis, agentive analysis, agentive analysis, try try try using them. Um, but using them. Um, but using them. Um, but we see that secrets are we see that secrets are we see that secrets are being blocked. being blocked. Right? We can Right? We can find and find and find and fix existing fix existing fix existing problems, and the new problems, and the new problems, and the new tasks we tasks we tasks we set are subject to a set are subject to a set are subject to a much stricter much stricter much stricter level of scrutiny. level of scrutiny. Thank you for your patience Thank you for your patience due to some due to some due to some network network network connectivity issues. I want connectivity issues. I want connectivity issues. I want to say that we, at to say that we, at to say that we, at Sonar, have a booth on the Sonar, have a booth on the Sonar, have a booth on the ground floor. I would be ground floor. I would be ground floor. I would be happy happy happy to chat with to chat with to chat with any of you. I'm any of you. I'm any of you. I'm happy happy happy to discuss both to discuss both to discuss both programming with programming with programming with artificial intelligence and artificial intelligence and artificial intelligence and anything else. Don't anything else. Don't anything else. Don't hesitate to come up hesitate to come up hesitate to come up to us and say hello.

to us and say hello. to us and say hello. We have souvenirs. We have souvenirs. We have souvenirs. We have Guitar Hero. We're We have Guitar Hero. We're We have Guitar Hero. We're having a having a having a real party there. real party there. Our Sonar community, community.sonarsource.com, seems to be a community.sonarsource.com, seems to be a great resource if great resource if great resource if you get you get you get stuck stuck stuck working with the working with the working with the repository in your repository in your repository in your spare time. There, our spare time. There, our spare time. There, our engineers who engineers who engineers who develop the product develop the product develop the product answer answer answer questions and questions and questions and help anyone who help anyone who help anyone who encounters encounters encounters difficulties. But difficulties. But difficulties. But thank you very much for listening thank you very much for listening thank you very much for listening and working with and working with and working with me. If you have me. If you have me. If you have any questions, any questions, any questions, feel free to come over feel free to come over feel free to come over or raise your hand and we'll get or raise your hand and we'll get or raise your hand and we'll get them sorted out. them sorted out. them sorted out. Thank you very much again for Thank you very much again for Thank you very much again for coming. My name is coming. My name is coming. My name is Kilian from Sonar, and Kilian from Sonar, and Kilian from Sonar, and I hope to see I hope to see I hope to see you at our booth. you at our booth. you at our booth. Thank you for your attention.