WEBVTT

NOTE Sentence-level transcript of https://www.youtube.com/watch?v=bI8WyG9YB0I

NOTE One cue per sentence. Cue ids are the line anchors on /transcripts/bI8WyG9YB0I.html. A cue ends where the next begins, or 2 s after its last word.

s1
00:00:13.120 --> 00:00:14.080
Cool.

s2
00:00:14.080 --> 00:00:23.359
Uh so I'm here from uh Codex's deployment engineering team and I want to quickly say a few things to introduce the amazing folks at Sonar as well as Killian.

s3
00:00:23.359 --> 00:00:30.480
Uh, so I'm gonna skip some of the agent basics I typically talk about because I get the feeling that this audience knows what they're doing when it comes into that.

s4
00:00:30.480 --> 00:00:36.320
We're gonna dive right into the harder questions like what does it mean for an agent to have completed a task?

s5
00:00:36.320 --> 00:00:38.559
What are trust boundaries?

s6
00:00:38.559 --> 00:00:42.879
And we have three kind of spicy claims that we want to present as well.

s7
00:00:42.879 --> 00:00:46.879
Uh, one is done means a task is completed with evidence.

s8
00:00:46.879 --> 00:00:53.360
two is that containment is not correctness and three is that the feedback contract belongs inside the loop.

s9
00:00:53.360 --> 00:00:57.760
So when we have an agent loop that tends to follow a few predictable patterns.

s10
00:00:57.760 --> 00:01:03.120
We tend to have this model action uh we have the execution that is governed by the model.

s11
00:01:03.120 --> 00:01:09.600
We observe the changes whether that be logs, results, output or otherwise and we continue updating the plan.

s12
00:01:09.600 --> 00:01:12.640
That's sort of like the overarching agent loop that we follow.

s13
00:01:12.640 --> 00:01:21.439
And then with each individual task, we have uh an outcome, we have invariance, we have a generally defined scope for what we're working on.

s14
00:01:21.439 --> 00:01:25.040
And of course, we also have acceptance criteria as well.

s15
00:01:25.040 --> 00:01:31.520
Uh so the definition of done for us typically it's a reviewable diff, some tool evidence, that type of thing.

s16
00:01:31.520 --> 00:01:33.600
It doesn't mean just saying fixed.

s17
00:01:33.600 --> 00:01:38.799
It actually means saying fixed and providing the evidence supporting this fact.

s18
00:01:38.799 --> 00:01:47.360
Uh so cheaper implementations tend to shift the bottleneck to specification and verification and that's really not what we're wanting to do.

s19
00:01:47.360 --> 00:01:56.799
Um there's this idea of correlated failure as well and there's typically a couple of common failure modes that coding agents uh tend to fall into.

s20
00:01:56.799 --> 00:02:00.079
it tends to fall back to incomplete context.

s21
00:02:00.079 --> 00:02:05.600
Uh where or maybe there's a local fix that violates some global invariance that we have.

s22
00:02:05.600 --> 00:02:13.760
Uh or better yet the the generated test that we actually do to verify results in the same issues just being propagated through.

s23
00:02:13.760 --> 00:02:24.400
Uh so selfcritique is useful but it's not an independent oracle and we often tend to find that some of the results of the agent and the verifier tend to be orthogonal

s24
00:02:24.400 --> 00:02:25.200
to each other.

s25
00:02:25.200 --> 00:02:29.840
You can't uh determine whether a task is done without looking at both parts of it.

s26
00:02:29.840 --> 00:02:40.640
Uh so you you typically want to almost seek out disconfirming evidence of a task being completed uh according to the compiler is it done according to the tests analysis

s27
00:02:40.640 --> 00:02:47.519
so on and so forth is it done and it's you can't really replace human review in the entire cycle as well.

s28
00:02:47.519 --> 00:02:53.280
Um the the next point I wanted to quickly hit on is uh containment doesn't equal correctness.

s29
00:02:53.280 --> 00:03:07.760
Uh we have the execution layer which typically defines what an agent can do right what tools does it have access to uh what scope does it have uh per view over what approvals does it need to act and then we have the uh

s30
00:03:07.760 --> 00:03:18.959
with this execution layer we have the artifact layer uh and this is really where the results are evaluated uh is the result acceptable uh what tests were produced what analyses

s31
00:03:18.959 --> 00:03:29.599
what policy even what intent is there Uh so a sandbox can contain a right but it can't prove that a query is safe.

s32
00:03:29.599 --> 00:03:37.519
Uh so what I'm trying to get at is that no oracle is proof and that you want to layer controls with different boundaries.

s33
00:03:37.519 --> 00:03:41.920
Sort of this defense and depth uh these multi-layers of guardrails.

s34
00:03:41.920 --> 00:03:44.000
That's sort of the overall idea.

s35
00:03:44.000 --> 00:03:46.632
And the great part about that is that you as a

s36
00:03:46.632 --> 00:03:46.720
[snorts]

s37
00:03:46.720 --> 00:03:54.159
human, you own the intent, you own the exceptions, and of course you own the decision whether to ship it or not.

s38
00:03:54.159 --> 00:03:55.840
Uh so this is one last thing.

s39
00:03:55.840 --> 00:04:00.640
Uh there's a feedback contract that we tend to advise as well.

s40
00:04:00.640 --> 00:04:07.760
Uh typically those come with skills um which of course are procedures as to how to accomplish a particular task.

s41
00:04:07.760 --> 00:04:19.120
uh MCPs contain structured tools and context and of course we are able to provide life cycle checks with hooks really good for finding out if you have hard-coded secrets or that kind of thing as well.

s42
00:04:19.120 --> 00:04:29.600
Uh so with this you want to create this full CI and human review process that should ultimately be the core of what the human's role is within this.

s43
00:04:29.600 --> 00:04:38.320
Uh and that sort of so anyways um what you want to evaluate when you are creating this sort of agentic process is a few things.

s44
00:04:38.320 --> 00:04:45.759
Uh what's the boundary for example uh are you able to uh intercept secrets before model input for example?

s45
00:04:45.759 --> 00:04:49.040
Uh how is the project grounded?

s46
00:04:49.040 --> 00:04:55.520
Uh do you have any concrete rules or locations or vulnerability paths that you are able to provide?

s47
00:04:55.520 --> 00:04:56.800
Uh what is the scope?

s48
00:04:56.800 --> 00:05:00.320
Are parameters binding while preserving behavior.

s49
00:05:00.320 --> 00:05:04.800
These are things to check for and of course you have to constantly run your rechecks.

s50
00:05:04.800 --> 00:05:09.520
Uh assert that the agents are not the terminal state.

s51
00:05:09.520 --> 00:05:13.199
Uh so anyways uh enough yapping from my end of things.

s52
00:05:13.199 --> 00:05:19.919
Uh if there's a three points that you take away from me, it's that done means a task is complete with evidence.

s53
00:05:19.919 --> 00:05:23.360
Two is that containment is not correctness.

s54
00:05:23.360 --> 00:05:32.088
And three is that the feedback contract belongs inside the loop so you can fully take advantage of the capabilities that your agents such as codeex provide.

s55
00:05:32.088 --> 00:05:32.560
[sighs]

s56
00:05:32.560 --> 00:05:38.240
Uh so Killian, let's uh let's make that loop uh complete, why don't we?

s57
00:05:38.320 --> 00:05:39.919
That's about all for mind of things.

s58
00:05:39.919 --> 00:05:45.600
So thank you so much for uh giving me the opportunity to give this introduction.

s59
00:05:46.080 --> 00:05:48.240
Thank you.

s60
00:05:50.160 --> 00:05:56.560
If you can take a look at this then um and and scan it and follow through it'll be very helpful.

s61
00:05:56.560 --> 00:05:58.320
There are a few prerequisites.

s62
00:05:58.320 --> 00:06:00.400
Um again I am Killian.

s63
00:06:00.400 --> 00:06:03.759
I am a developer content engineer at Sonar.

s64
00:06:03.759 --> 00:06:10.720
Um, so thank you very much again, um, OpenAI and Tony for giving us a little intro into all of this.

s65
00:06:10.720 --> 00:06:13.840
Um, Codeex is a very powerful tool.

s66
00:06:13.840 --> 00:06:14.960
I use it all the time.

s67
00:06:14.960 --> 00:06:16.639
I found it very helpful.

s68
00:06:16.639 --> 00:06:18.479
It's has a fast CLI.

s69
00:06:18.479 --> 00:06:30.479
It has a, uh, pretty smart sandbox system and the hook system that it has as well integrates really well with tools like Sonic Cube like I'd like to hop into today.

s70
00:06:31.280 --> 00:06:39.120
So, wiring your team for agentic development with sonar cube and open AI.

s71
00:06:39.120 --> 00:06:50.000
Um, the question I want to pose today is how do we make sure that the code and the output generated by agents like codeex is verified that it's safe.

s72
00:06:50.000 --> 00:06:55.600
At Soner, we have this idea of the agent centric development cycle.

s73
00:06:55.600 --> 00:07:10.479
We did um some some research in the past year or so and we surveyed over a thousand developers and we found that uh 42% of committed code is either AI generated or AI assisted

s74
00:07:10.479 --> 00:07:15.680
but 96% of developers do not fully trust it.

s75
00:07:15.680 --> 00:07:16.160
Right?

s76
00:07:16.160 --> 00:07:21.039
So the vast majority of people do not just think hey this is safe right off the bat.

s77
00:07:21.039 --> 00:07:27.039
Less than half of them say that they fully verify the code before they push and merge it into the codebase.

s78
00:07:27.039 --> 00:07:28.560
There's a bit of tension there.

s79
00:07:28.560 --> 00:07:30.000
No one trusts it.

s80
00:07:30.000 --> 00:07:34.000
A bunch of untr untrusted code is getting into the codebase.

s81
00:07:34.000 --> 00:07:40.639
Um the reason being is that the bottleneck used to be code generation, right?

s82
00:07:40.639 --> 00:07:46.080
How can we create what we're what we're trying to do to achieve the desired outcome?

s83
00:07:46.080 --> 00:07:50.560
How do we actually write the code for an application that we're trying to build?

s84
00:07:50.560 --> 00:07:58.879
um with AI agents that has for the most part part been solved with them either doing it themselves or with the assistance of of AI agents.

s85
00:07:58.879 --> 00:08:04.560
So the bottleneck has shifted now from just code generation to code verification.

s86
00:08:04.560 --> 00:08:04.879
Right?

s87
00:08:04.879 --> 00:08:14.319
We have a massive amount of code being generated but now it is up to the human limitation of hey how do I make sure that this is safe?

s88
00:08:14.319 --> 00:08:24.879
what help and what tools can I get to verify that this is not going to nuke my codebase or nuke my customers and create all sorts of bad uh issues going on.

s89
00:08:24.879 --> 00:08:30.560
So we have uh four steps in the AC/DC the agentcentric development cycle.

s90
00:08:30.560 --> 00:08:44.399
One of them is not necessarily from sonar that is generate that is whatever coding tool you're using codeex anything else um that is the generate step but sonar owns guide verify and solve.

s91
00:08:44.399 --> 00:08:55.839
What guide is is we inject the agent with proper context and that includes your project guidelines, any rules, any specific architecture to make sure that it has high quality

s92
00:08:55.839 --> 00:08:58.720
context before it even starts building anything.

s93
00:08:58.720 --> 00:09:06.320
We found that this reduces token cost overall and at enterprise scale that I mean saves a lot of money in the long term.

s94
00:09:06.320 --> 00:09:15.279
verify is as soon as it's done creating uh whatever task you've assigned to a generated code, we want to make sure that no issues are being introduced.

s95
00:09:15.279 --> 00:09:20.320
So no security issues, code quality issues, maintainability, anything like that.

s96
00:09:20.320 --> 00:09:23.040
None of that needs to be pushed out to production code.

s97
00:09:23.040 --> 00:09:28.800
And then solve is okay, we have detected there's an issue, right?

s98
00:09:28.800 --> 00:09:33.120
There's some sort of injection vulnerability or whatever that's going on.

s99
00:09:33.120 --> 00:09:44.320
we need to remediate that quickly um and as efficiently as possible so that we can kind of have this iterative coding system right there.

s100
00:09:44.320 --> 00:09:52.240
And the last slide I'm going to show before we hop into the actual activity is uh the concept of the inner loop and the outer loop of verification.

s101
00:09:52.240 --> 00:09:57.360
Outer loop is your traditional CI system that you have set up, right?

s102
00:09:57.360 --> 00:10:04.959
So you write code, you push it to GitHub, GitLab, whatever you use, the pipeline runs and something may fail, right?

s103
00:10:04.959 --> 00:10:14.880
Your test or a scan or sonar cube may fail and then you go back to the IDE and then you try and fix it and then you push it and then it fails again.

s104
00:10:14.880 --> 00:10:20.160
This has been the bane of my existence, the bane of many developers existences.

s105
00:10:20.160 --> 00:10:25.760
So we want to save time by shifting left to the interloop and that's the IDE.

s106
00:10:25.760 --> 00:10:35.440
So that's as soon as we are done generating code, we want to verify that it is correct within the IDE without having to push it out.

s107
00:10:35.440 --> 00:10:38.160
Um, this saves a lot of time.

s108
00:10:38.160 --> 00:10:44.720
Uh, I mean, especially, you know, being able to automatically verify all this stuff.

s109
00:10:44.720 --> 00:10:52.640
Time is money at at enterprises and your engineers save a lot of money on therapy bills as well without that frustration.

s110
00:10:52.640 --> 00:11:00.902
Um all right that is the last slide I really want to focus on uh before hopping into the terminal.

s111
00:11:00.902 --> 00:11:00.959
[snorts]

s112
00:11:00.959 --> 00:11:09.920
Uh a few quick things I want to touch base on before that you're going to see two uh two tools that I'm going to talk about our tool for context

s113
00:11:09.920 --> 00:11:19.040
our tool called context augmentation is what we're going to use for the guide stage and our tool for agentic analysis you're going to see in the verify stage.

s114
00:11:19.040 --> 00:11:20.552
We'll come back to those later.

s115
00:11:20.552 --> 00:11:21.120
[snorts]

s116
00:11:21.120 --> 00:11:31.440
Um, and the the big takeaway as well that I want everyone to keep focusing on is this bottleneck has shifted from code generation to code verification.

s117
00:11:31.440 --> 00:11:38.640
Um, before we hop in as well, everyone should have Docker running if you're able to on your computer.

s118
00:11:38.640 --> 00:11:44.720
And just quick show of thumbs just so I have an idea of people who have been able to follow along with the prerequisites so far.

s119
00:11:44.720 --> 00:11:49.680
Thumbs up if you got Docker running and are kind of primed, ready to go.

s120
00:11:49.680 --> 00:11:52.240
hop into the terminal and follow along.

s121
00:11:52.240 --> 00:11:52.959
Awesome.

s122
00:11:52.959 --> 00:11:53.920
A few.

s123
00:11:53.920 --> 00:11:54.800
Perfect.

s124
00:11:54.800 --> 00:11:55.760
Thank you.

s125
00:11:55.760 --> 00:11:58.800
Um if not, again, this repo is available.

s126
00:11:58.800 --> 00:12:01.680
You can follow through with this on your own time.

s127
00:12:01.680 --> 00:12:04.640
Um you will have all of this information.

s128
00:12:04.640 --> 00:12:07.040
So, let me pop out of this real quick.

s129
00:12:07.040 --> 00:12:09.120
I only have limited view.

s130
00:12:09.120 --> 00:12:13.120
Cutting the top part of my screen off, but should be good to go.

s131
00:12:13.120 --> 00:12:14.560
All right.

s132
00:12:14.560 --> 00:12:19.680
So the first thing that we are going to do is we are going to run this script called apply sonar.

s133
00:12:19.680 --> 00:12:22.778
Um this is just the the repo that I clone locally.

s134
00:12:22.778 --> 00:12:23.040
[snorts]

s135
00:12:23.040 --> 00:12:24.959
This is going to require a bash terminal.

s136
00:12:24.959 --> 00:12:28.480
So if you're on Windows you can use git bash or something like that.

s137
00:12:28.480 --> 00:12:31.839
Um so I'm going to go ahead and type that in.

s138
00:12:31.839 --> 00:12:37.360
That is apply sonar.

s139
00:12:38.079 --> 00:12:38.800
All right.

s140
00:12:38.800 --> 00:12:41.120
And this is going to do a few things.

s141
00:12:41.120 --> 00:12:43.360
This is a personal tool that I built.

s142
00:12:43.360 --> 00:12:45.920
It is not an official Sonar product.

s143
00:12:45.920 --> 00:12:48.399
Um, it is just a shortcut.

s144
00:12:48.399 --> 00:12:53.120
So, we're not spending 10 minutes clicking through a UI or anything like that.

s145
00:12:53.120 --> 00:12:56.240
Make sure my Wi-Fi is doing all right.

s146
00:12:56.240 --> 00:12:58.240
Okay.

s147
00:13:00.320 --> 00:13:03.120
Running through a little bit of computer slowness up here.

s148
00:13:03.120 --> 00:13:07.760
Um, but it'll this will create a Sonar Cube cloud project for you.

s149
00:13:07.760 --> 00:13:11.360
Um, runs the first scan for you.

s150
00:13:12.480 --> 00:13:16.959
Okay, EU and it will off me in.

s151
00:13:16.959 --> 00:13:19.760
So, we'll just pop open the browser.

s152
00:13:19.760 --> 00:13:32.160
Um, this will install a few related Sonar Cube tools for you like our CLI and anything else that we're going to need to run our plugin with Codeex on top of.

s153
00:13:36.079 --> 00:13:44.880
All right, bear with me as it looks like I'm bumping into just a little bit of Wi-Fi slowness in here, but shouldn't be a big issue.

s154
00:13:44.880 --> 00:13:48.880
So, that has been successful.

s155
00:13:51.360 --> 00:13:55.440
Um, you're going to want to put in um the org that you want.

s156
00:13:55.440 --> 00:14:01.684
So, the org that you were created that was uh created for you when you made an account.

s157
00:14:01.684 --> 00:14:03.684
[snorts]

s158
00:14:06.079 --> 00:14:07.040
and that'll run.

s159
00:14:07.040 --> 00:14:13.519
Um, this right here, just to talk about the project, this is a tiny Python project.

s160
00:14:13.519 --> 00:14:14.720
Nothing complicated.

s161
00:14:14.720 --> 00:14:18.160
There's like four files, less than 200 lines total.

s162
00:14:18.160 --> 00:14:21.440
And I have planted four vulnerabilities in there.

s163
00:14:21.440 --> 00:14:27.440
Three of them are security vulnerabilities and one of them is a code smell.

s164
00:14:27.440 --> 00:14:36.399
And um when this script gets done running, then we're going to hop into the dashboard and make sure that uh we can see stuff up there.

s165
00:14:37.279 --> 00:14:39.279
All right.

s166
00:14:39.920 --> 00:14:43.760
Normally, uh I think there's a lot of people trying to access this Wi-Fi.

s167
00:14:43.760 --> 00:14:47.760
Uh I've not seen this take longer than a minute on my own personal Wi-Fi.

s168
00:14:47.760 --> 00:14:53.920
So, if you're following along at home, don't think you'll have to be sitting around like this um for a little while.

s169
00:14:53.920 --> 00:14:55.920
Whoops.

s170
00:15:01.760 --> 00:15:03.120
So, I am You know what?

s171
00:15:03.120 --> 00:15:08.399
I may have actually forgot to export my token, which is a step in the repo real quick.

s172
00:15:08.399 --> 00:15:12.160
So, um this should be in your shell.

s173
00:15:12.160 --> 00:15:19.920
I'm going to pull out my disconnect real quick just for a second so I don't expose my sonar token to a room full of a bunch of people.

s174
00:15:19.920 --> 00:15:22.959
And then I'll pop right back in.

s175
00:15:27.760 --> 00:15:31.360
Uh so there should be some steps in the the repository.

s176
00:15:31.360 --> 00:15:33.279
You will navigate through the dashboard.

s177
00:15:33.279 --> 00:15:37.600
I think it's under administration within sonarcube cloud.

s178
00:15:48.079 --> 00:15:48.720
All right.

s179
00:15:48.720 --> 00:15:50.959
re mirror.

s180
00:15:55.600 --> 00:15:56.720
All right.

s181
00:15:56.720 --> 00:15:58.560
So, this will run.

s182
00:15:58.560 --> 00:16:01.360
Um, a few things I want to talk about as well.

s183
00:16:01.360 --> 00:16:06.639
So, we are going to see a uh SQL injection issue that pops in.

s184
00:16:06.639 --> 00:16:07.600
Okay, awesome.

s185
00:16:07.600 --> 00:16:09.279
This looks like it's working now.

s186
00:16:09.279 --> 00:16:16.000
Um, so it'll go through and it'll automatically create um everything for me in the dashboard.

s187
00:16:16.000 --> 00:16:21.360
The security rating that it will come up with is going to be E. This is the very lowest.

s188
00:16:21.360 --> 00:16:31.040
We have uh baked in some security issues and uh Sonar Cube immediately detects these and says, "Hey, this is no good."

s189
00:16:31.040 --> 00:16:37.279
The next thing that I'm going to dig into as soon as this gets loaded is just walk through a couple issues.

s190
00:16:37.279 --> 00:16:41.680
One of them is going to be an open AP uh open AI API key.

s191
00:16:41.680 --> 00:16:44.240
Very relevant if people are using codecs.

s192
00:16:44.240 --> 00:16:45.440
I have done this.

s193
00:16:45.440 --> 00:16:48.320
It's actually right here in the codebase.

s194
00:16:48.320 --> 00:16:53.920
Oops, someone forgot to use an env file or pass this in as a variable.

s195
00:16:53.920 --> 00:16:56.320
Um, this happens all the time.

s196
00:16:56.320 --> 00:17:00.959
And what a lot of times what happens is people accidentally push these into production code.

s197
00:17:00.959 --> 00:17:09.679
Um, and the average remediation time for a secret in a public repository is 90 days right now.

s198
00:17:09.679 --> 00:17:10.880
That is crazy.

s199
00:17:10.880 --> 00:17:17.280
that is your your token is just sitting out there for all the world to see, all the bots to scrape for 90 days.

s200
00:17:17.280 --> 00:17:22.480
We want to prevent this as much as possible and we have a couple tools for that here.

s201
00:17:22.480 --> 00:17:31.520
Um, another issue that I'm going to highlight for y'all here in a second is there is a SQL injection vulnerability.

s202
00:17:31.520 --> 00:17:46.000
Um, and if anyone who was just perusing through this code is a security wiz, you may have noticed it, but um, right here in this database.py file, I am passing in

s203
00:17:46.000 --> 00:17:53.840
um, a query from here directly into an fstring that is being uh, cursor executed.

s204
00:17:53.840 --> 00:17:57.440
So the argument is going straight into the string.

s205
00:17:57.440 --> 00:18:14.400
That is bad news bears especially because this um function search task is being uh given an argument from cy.orgv that means that anybody who controls cy.orgv RV gets to control your database,

s206
00:18:14.400 --> 00:18:15.039
right?

s207
00:18:15.039 --> 00:18:16.480
This is really bad.

s208
00:18:16.480 --> 00:18:22.799
Sonar Cube is able to detect this and will let you know, hey, here is the data flow that we're detecting.

s209
00:18:22.799 --> 00:18:32.880
It's using symbolic execution and taint analysis to identify the data flow and and trace it as it moves through your application.

s210
00:18:33.600 --> 00:18:38.320
Um, there's going to be a few things that we do as soon as this is set up.

s211
00:18:38.320 --> 00:18:46.320
One of them is um installing the the sonar cube codeex marketplace.

s212
00:18:46.320 --> 00:18:48.799
Another one is wiring that to your project.

s213
00:18:48.799 --> 00:18:56.880
And then another one is um making sure that everything is is connected in the plugin.

s214
00:18:56.880 --> 00:18:59.360
So this is almost done here.

s215
00:18:59.360 --> 00:19:01.760
Apologize for that short wait, folks.

s216
00:19:01.760 --> 00:19:12.559
Um, and if you are running this yourself, hopefully it is um either finished so far or or almost done.

s217
00:19:12.559 --> 00:19:14.240
This will be done momentarily.

s218
00:19:14.240 --> 00:19:17.398
But the three tools that I'm going to focus on today are

s219
00:19:17.398 --> 00:19:17.760
[snorts]

s220
00:19:17.760 --> 00:19:22.240
the um the secrets detection hook that we offer.

s221
00:19:22.240 --> 00:19:31.600
We also have a uh list issues tool through codecs and that allows you to see any of the issues from sonar cube within the terminal.

s222
00:19:31.600 --> 00:19:40.880
And then the third one is being able to find and fix issues from those listed issues that we pull in in in the plugin itself.

s223
00:19:40.978 --> 00:19:42.240
[snorts]

s224
00:19:42.240 --> 00:19:44.880
Any questions so far from anyone?

s225
00:19:44.880 --> 00:19:50.240
If you have questions, by the way, if your setup's not working, we have our lovely team from Sonar over there.

s226
00:19:50.240 --> 00:19:51.760
They're going to wave hi real quick.

s227
00:19:51.760 --> 00:20:00.880
Um, if you raise your hand and bump into anything, they are more than happy to come over and talk to you and and help you through everything.

s228
00:20:04.000 --> 00:20:12.720
All right, analysis complete and I can go ahead and click into my dashboard.

s229
00:20:16.960 --> 00:20:19.520
Open that up.

s230
00:20:20.160 --> 00:20:29.760
Like I said, this is going to be our Sonar Cube cloud dashboard that shows you all of the issues that it's detected um within your project.

s231
00:20:31.120 --> 00:20:38.720
And if you've had any issues with Wi-Fi or or being able to install any of the prerequisites, um again, no problem.

s232
00:20:38.720 --> 00:20:47.520
This repo that you scanned uh the QR code for, just reload that.

s233
00:20:47.520 --> 00:20:51.360
That repo is going to be up for you.

s234
00:21:00.159 --> 00:21:01.679
All right.

s235
00:21:01.679 --> 00:21:05.760
So, here's the dashboard and I'm not going to spend too much time here.

s236
00:21:05.760 --> 00:21:12.480
Um, but we can see here that this security rating is E. There are those three security issues.

s237
00:21:12.480 --> 00:21:13.760
There are four total.

s238
00:21:13.760 --> 00:21:22.559
If I click on this, we can see here is that OpenAI API key that was able to detect uh that that's here.

s239
00:21:22.559 --> 00:21:25.520
Um just plain text in the source code.

s240
00:21:25.520 --> 00:21:32.000
And if I go back, the other one I want to focus on is this SQL injection vulnerability right here.

s241
00:21:32.000 --> 00:21:36.799
This is the one I talked to uh y'all with the the CIS.orgv issue.

s242
00:21:36.799 --> 00:21:46.880
And this is taint analysis tracing the data flow from the source here all the way through different files and functions into the sync right here.

s243
00:21:46.880 --> 00:21:49.120
Very very helpful.

s244
00:21:49.120 --> 00:21:54.720
All right, popping back over to the terminal.

s245
00:21:54.720 --> 00:22:00.799
Um, let me hop over to my handy dandy uh command clipboard that I have here.

s246
00:22:00.799 --> 00:22:05.600
I'm going to do codeex uh plugin marketplace add.

s247
00:22:05.600 --> 00:22:11.200
And what that's going to do is that's just going to add the Sonar Cube Marketplace here.

s248
00:22:13.200 --> 00:22:27.520
And um this as soon as that's in, we're going to hop into a codeex itself, we will see the Sonar Cube uh plugin available and we'll be able to select that.

s249
00:22:27.679 --> 00:22:29.840
So give that a few seconds.

s250
00:22:29.840 --> 00:22:38.000
Uh, appreciate all of you all folks being able to bear with me as I bump into just minor connectivity slowness.

s251
00:22:38.080 --> 00:22:44.880
Again, in your normal agentic workflows, I'm sure things will be moving much faster for you.

s252
00:22:45.600 --> 00:22:46.400
Perfect.

s253
00:22:46.400 --> 00:22:49.120
I'm going to pop open codeex.

s254
00:22:49.120 --> 00:22:50.240
Sweet.

s255
00:22:50.240 --> 00:22:57.200
And I'm going to do slashplugins and then just search for sonar cube and install it.

s256
00:22:57.200 --> 00:23:09.120
So that is get the marketplace run it slashplugins uh invocation and then type in sonar cube and that is installed.

s257
00:23:12.080 --> 00:23:12.240
Right.

s258
00:23:12.240 --> 00:23:17.200
I'm going to exit out of this so that it can reload and so I can just run a couple more commands.

s259
00:23:17.200 --> 00:23:27.440
Um, I'm going to uh say sonar off login.

s260
00:23:27.840 --> 00:23:39.520
That's just going to authenticate the CLI um which uh will allow us to use a lot of the capabilities that the plug-in is built off of.

s261
00:23:41.440 --> 00:23:52.000
After that, uh, we're going to get to finally the the final wiring step, which is just Sonar integrate codecs as soon as this gets off for us.

s262
00:23:52.000 --> 00:23:53.360
Yep.

s263
00:23:53.360 --> 00:23:54.559
Allow that.

s264
00:23:54.559 --> 00:23:56.559
Perfect.

s265
00:24:01.600 --> 00:24:05.280
So, that will take hopefully not too too much longer.

s266
00:24:05.280 --> 00:24:06.480
Uh, a couple seconds.

s267
00:24:06.480 --> 00:24:14.080
get that updated and then we'll write um do this integrate codeex command here.

s268
00:24:26.799 --> 00:24:29.120
Oh, looks like it's running into some more.

s269
00:24:29.120 --> 00:24:34.320
Um try that.

s270
00:24:34.320 --> 00:24:40.240
Look like for some reason the the Sonor token which is exported is getting lost.

s271
00:24:50.799 --> 00:24:54.080
Pop back in for youall real quick.

s272
00:25:01.440 --> 00:25:05.200
See if you can't see my screen again.

s273
00:25:07.679 --> 00:25:09.679
Perfect.

s274
00:25:11.039 --> 00:25:16.640
I'm going to go to the clipboard and pull this back over.

s275
00:25:21.840 --> 00:25:22.720
All right.

s276
00:25:22.720 --> 00:25:25.520
So, uh, what this is going to do is a few different things.

s277
00:25:25.520 --> 00:25:28.480
This is going to get you your secrets detection hook.

s278
00:25:28.480 --> 00:25:43.679
This is going to get you your agents uh MD directive to use all the solder cube skills and this is going to give you um other skills and uh the MCP config as well.

s279
00:25:45.520 --> 00:25:46.320
It's perfect.

s280
00:25:46.320 --> 00:25:55.440
This is just going to go on a little bit longer and then everything will be fully wired up to use the Sonar Cube codeex plugin.

s281
00:25:56.799 --> 00:25:57.600
Quick time check.

s282
00:25:57.600 --> 00:26:00.559
Okay, we should be good.

s283
00:26:02.159 --> 00:26:09.760
So for me, this is going to install uh two extra things that some of you who are using the free account may not see.

s284
00:26:09.760 --> 00:26:14.880
That is context augmentation and that is agentic analysis.

s285
00:26:14.880 --> 00:26:22.080
Uh agentic analysis is a hook that fires instantly after any edit that the agent does.

s286
00:26:22.080 --> 00:26:33.600
So if you tell it to write a file or modify any file, it will automatically execute and that runs serverside analysis on the code that was just written.

s287
00:26:33.600 --> 00:26:44.080
What context augmentation does is it detects hey when it's about to do something when Codex is about to perform a task then it will feed it with the the guidelines

s288
00:26:44.080 --> 00:26:47.520
and uh relevant architecture and other information like that.

s289
00:26:47.520 --> 00:26:51.360
Okay, we are we are finally rocking and rolling here folks.

s290
00:26:51.360 --> 00:26:53.520
We have a few things that were added.

s291
00:26:53.520 --> 00:26:56.320
Um, specifically some hooks in here.

s292
00:26:56.320 --> 00:26:58.559
There are some skills under the hood as well.

s293
00:26:58.559 --> 00:27:03.279
And I'm going to copy this real quick.

s294
00:27:03.279 --> 00:27:06.240
So, I'm going to pop open codeex.

s295
00:27:06.240 --> 00:27:08.080
Trust all of these hooks.

s296
00:27:08.080 --> 00:27:09.840
Thank you, sandbox.

s297
00:27:09.840 --> 00:27:15.360
And the uh the MCP server is getting booted up with sonar cube.

s298
00:27:15.360 --> 00:27:20.480
I'm going to do is I'm going to say, hey, can you push a commit using my token?

s299
00:27:20.480 --> 00:27:28.480
This is a a fake secret that um the the plug-in suggests that you try with immediately.

s300
00:27:28.480 --> 00:27:30.720
Say sure.

s301
00:27:32.000 --> 00:27:35.520
So you can see instantly this was blocked.

s302
00:27:35.520 --> 00:27:39.200
No secrets were leaked into the L1 context.

s303
00:27:39.200 --> 00:27:42.400
Nothing is being stored in any logs or anything like that.

s304
00:27:42.400 --> 00:27:48.080
As well if you ask it to read a file with a secret in it, it will not do it.

s305
00:27:48.080 --> 00:27:48.960
It will be blocked.

s306
00:27:48.960 --> 00:27:57.120
Codex never gets to look at any of your uh secrets or anything like that that are that are being leaked into your context.

s307
00:27:57.120 --> 00:27:58.640
This is super important.

s308
00:27:58.640 --> 00:28:00.000
People do it all the time.

s309
00:28:00.000 --> 00:28:01.840
We all know what to do.

s310
00:28:01.840 --> 00:28:03.840
Yes.

s311
00:28:08.320 --> 00:28:10.960
Write a script to read the file.

s312
00:28:10.960 --> 00:28:12.960
So,

s313
00:28:13.919 --> 00:28:15.600
that's possible.

s314
00:28:15.600 --> 00:28:19.120
Um, this mainly works on the tool use, right?

s315
00:28:19.120 --> 00:28:24.399
It's it's a hook that's invoked on on the the user prompt submit tool.

s316
00:28:24.399 --> 00:28:29.279
So, if that is bypassed, then it is possible that that hook may not be invoked.

s317
00:28:29.279 --> 00:28:42.799
But for basic usage of um codecs and its tools and and and prompting it and things like that, if you leak any um secrets into the prompt or if there's anything, it will detect that.

s318
00:28:42.799 --> 00:28:46.480
Uh, looks like we're having a little bit of internet connectivity right here.

s319
00:28:46.480 --> 00:28:52.320
Uh, I'm going to reaunch up that MCP server real quick.

s320
00:29:00.080 --> 00:29:11.200
And so what the MCP server is going to allow us to do is to use the skills that allow us to interact uh with between codecs and and the Sonar Cube cloud

s321
00:29:11.200 --> 00:29:13.120
uh dashboard that we saw earlier.

s322
00:29:13.120 --> 00:29:22.399
For instance, if we were to say, hey, list all of the issues in my project, it's able to fetch that and uh and return information to us.

s323
00:29:22.399 --> 00:29:40.320
I'm just going to go ahead and exit out of this real quick and open it back up and get that Sonar Cube MCP server booted right back up.

s324
00:29:45.440 --> 00:29:47.440
Yes.

s325
00:30:02.799 --> 00:30:04.799
I am very sorry it's hard for me to hear.

s326
00:30:04.799 --> 00:30:06.799
Would you mind walking up or speaking a little louder?

s327
00:30:06.799 --> 00:30:08.799
Louder.

s328
00:30:15.200 --> 00:30:17.200
Yes.

s329
00:30:30.399 --> 00:30:31.679
running this on my own.

s330
00:30:31.679 --> 00:30:38.640
The apply sonar script that get gets us all provisioned for me never takes longer than a minute if I'm running it on my own.

s331
00:30:38.640 --> 00:30:45.600
Um everything else the MCP is is about as long as any other MCP that it takes assuming normal connectivity.

s332
00:30:45.600 --> 00:30:56.559
Um, I'm doing my best to work with the connectivity here, but um, outside of that, I would say there's no extra, uh, overhead that any of these really apply

s333
00:30:56.559 --> 00:31:02.240
for or any of these add to a normal, um, developer workflow.

s334
00:31:04.240 --> 00:31:10.000
So, I'm going to double check that that MCP is uh, up and running real quick.

s335
00:31:14.000 --> 00:31:23.440
And um like I said, what what the MCP does is allows you to have access to all of the tools to where anytime you ask it to do something related

s336
00:31:23.440 --> 00:31:32.399
to uh Sonar, like the issues in your project, it automatically detects what's going on um and and will invoke any of those relevant skills.

s337
00:31:32.399 --> 00:31:44.799
One of those skills is context augmentation, which is knowing that okay, we have the sonar cube tools, but our network does not seem to be populating uh the MCP

s338
00:31:44.799 --> 00:31:47.360
with any of that.

s339
00:31:48.480 --> 00:31:49.120
Let me see.

s340
00:31:49.120 --> 00:31:51.120
Let me see if it'll work with us regardless.

s341
00:31:51.120 --> 00:31:58.480
Let me say list the issues in my project.

s342
00:32:00.559 --> 00:32:03.919
Um, any other questions so far?

s343
00:32:03.919 --> 00:32:05.760
Figure I might as well take a few while we're waiting.

s344
00:32:05.760 --> 00:32:07.760
Yes.

s345
00:32:10.720 --> 00:32:10.960
Yes.

s346
00:32:10.960 --> 00:32:15.600
So, the the the CLI um actually only sets up the configuration.

s347
00:32:15.600 --> 00:32:18.960
The MCP runs within Docker.

s348
00:32:18.960 --> 00:32:26.559
So, it will sometimes go through the MCP if it's using any of the skills um that it has there.

s349
00:32:26.559 --> 00:32:35.679
But for the most part, this plugin and everything just sets up the configuration and then invokes um skills through there.

s350
00:32:37.120 --> 00:32:41.840
The the the CLI helps you provision and set up the MCP and everything like that.

s351
00:32:41.840 --> 00:32:47.039
And then there are commands that you're able to to invoke through the MCP with the CLI.

s352
00:32:47.039 --> 00:32:48.320
And I want to clarify the difference.

s353
00:32:48.320 --> 00:32:51.360
There's a CLI that this plug-in lives on top of.

s354
00:32:51.360 --> 00:33:02.960
So there are certain things where you can say hey execute um you know this this task for me and it may route through route it through an MCP skill

s355
00:33:02.960 --> 00:33:06.159
or through a CLI command.

s356
00:33:06.960 --> 00:33:14.240
Okay so looks like we have the MCP it's just running very slow because of network because it was able to detect that for us.

s357
00:33:14.240 --> 00:33:30.720
So in our list issue skill as well as this context augmentation skill we can also see that hey even when it's looking at its skills we are running the secret scan and making sure that there are no uh API keys

s358
00:33:30.720 --> 00:33:39.679
nothing like that uh leaked in uh when it when it takes a look at at any of its files including its own skill files.

s359
00:33:40.240 --> 00:33:44.320
Okay, we're valid.

s360
00:33:44.320 --> 00:33:49.760
It's looking through all of these and again um running into network connectivity here.

s361
00:33:49.760 --> 00:33:53.919
This should all happen in a normal uh agentic workflow.

s362
00:33:53.919 --> 00:33:55.763
Uh much quicker than that.

s363
00:33:55.763 --> 00:33:56.640
[snorts]

s364
00:33:56.640 --> 00:34:03.120
Any other questions I can take while we wait for this to to to boot up a little bit?

s365
00:34:06.720 --> 00:34:10.800
Uh enterprise server.

s366
00:34:10.960 --> 00:34:11.760
Yeah, absolutely.

s367
00:34:11.760 --> 00:34:16.399
This is available across any levels of of Sonar Cube use.

s368
00:34:16.399 --> 00:34:20.560
Be that cloud, be that server, be that enterprise, be that the free tier.

s369
00:34:20.560 --> 00:34:22.960
Um, everybody should have access to this.

s370
00:34:22.960 --> 00:34:33.359
Now, uh, the limitation there is uh, context augmentation and agentic analysis are two tools that we do not offer on the free tier.

s371
00:34:33.359 --> 00:34:40.240
Um, but if you have those entitlements in your org, then you'll be able to use those tools.

s372
00:34:41.839 --> 00:34:44.000
All right.

s373
00:34:45.760 --> 00:34:53.679
So, we were able to see that we can get those same issues that we saw in the dashboard now available in the CLI.

s374
00:34:53.679 --> 00:35:01.040
Imagine that this took 15 seconds and that the uh that the engineer has a fully connected Wi-Fi connection.

s375
00:35:01.040 --> 00:35:06.800
Um they will have this available very quickly within their IDE.

s376
00:35:06.800 --> 00:35:13.680
Here is the uh uh secret blocked uh blocker severity that I mentioned earlier.

s377
00:35:13.680 --> 00:35:19.119
But the one that I want to highlight and get fixed today is this S8702.

s378
00:35:19.119 --> 00:35:23.839
This is a rule that we wrote specifically for AI agentic workflows.

s379
00:35:23.839 --> 00:35:30.400
We do not want AI coding agents to write code that other agents are able to exploit.

s380
00:35:30.400 --> 00:35:34.800
That is the cy.orgv flow that I described a little bit earlier.

s381
00:35:34.800 --> 00:35:43.040
Again, anybody who has access to cy.orgv will be able to have control over your database.

s382
00:35:43.040 --> 00:35:44.000
We want to prevent this.

s383
00:35:44.000 --> 00:35:51.520
So, I'm just going to tell uh codeex say, hey, fix s2.

s384
00:35:53.920 --> 00:35:55.119
That's going to run.

s385
00:35:55.119 --> 00:36:03.680
And again, all of these issues, you can instantly pull them to your terminal and ask codeex to fix it.

s386
00:36:03.680 --> 00:36:14.160
There was going to be something that is different on my machine versus anybody following along is that is you'll see as soon as code is edited and changed here.

s387
00:36:14.160 --> 00:36:19.040
The post tool use hook for agentic analysis will run.

s388
00:36:19.040 --> 00:36:28.720
What that does is if there were any new vulnerabilities introduced in the fix sonar cube will scan it server side.

s389
00:36:28.720 --> 00:36:32.079
If you do not have agentic analysis that is totally fine.

s390
00:36:32.079 --> 00:36:38.320
you can just scan your code uh during your next uh CI push or anything like that.

s391
00:36:38.320 --> 00:36:50.320
But um regardless it will get verified using a gentic analysis just closes that loop and gives you automatic feedback to know that hey I have not introduced any more issues.

s392
00:36:50.320 --> 00:36:58.160
Um, I don't know about y'all, but I have been in uh coding sessions sometimes where I'm like, "Hey, fix this issue."

s393
00:36:58.160 --> 00:37:05.920
And then three more kind of pop up and I'm trying to fix those and it's like trying to conquer a hydra where these just kind of propagate out.

s394
00:37:05.920 --> 00:37:12.880
Using this automatically verifies that you're not causing any new uh vulnerabilities to come about.

s395
00:37:12.880 --> 00:37:13.680
Awesome.

s396
00:37:13.680 --> 00:37:15.839
So, we were we were able to fix this.

s397
00:37:15.839 --> 00:37:18.079
We get a parameterized query.

s398
00:37:18.079 --> 00:37:19.119
Wonderful.

s399
00:37:19.119 --> 00:37:23.280
Um, and this post tool use hook completes.

s400
00:37:23.280 --> 00:37:27.839
What it lets you know is is it lets you know there is an issue in the file.

s401
00:37:27.839 --> 00:37:30.880
However, that existed beforehand.

s402
00:37:30.880 --> 00:37:34.000
That was one of the issues that I had already pre-baked in here.

s403
00:37:34.000 --> 00:37:38.320
So, it's not going to try and solve everything else in your file for you.

s404
00:37:38.320 --> 00:37:48.960
it is smart and it just realizes that hey whatever was in the code that we changed we're going to uh analyze that and make sure that there are no new issues

s405
00:37:48.960 --> 00:37:51.280
introduced from that code.

s406
00:37:51.280 --> 00:37:53.200
So wonderful.

s407
00:37:53.200 --> 00:37:58.960
Um it reanalyzed that code in line and verified that it passed.

s408
00:37:58.960 --> 00:38:04.640
Um and we no longer report uh S8702.

s409
00:38:04.720 --> 00:38:16.560
So we are able to find and fix and automatically verify um new code uh as it comes into our workspace.

s410
00:38:16.640 --> 00:38:18.720
All right.

s411
00:38:19.119 --> 00:38:21.920
So I want to leave a little bit of time for questions at the end.

s412
00:38:21.920 --> 00:38:26.640
So I'm just going to um move through to this last piece here.

s413
00:38:26.640 --> 00:38:32.160
And this is um adding a new function, right?

s414
00:38:32.160 --> 00:38:35.280
delete a task by ID to database.py.

s415
00:38:35.280 --> 00:38:41.280
And this when asking it to come up with uh new code, it will use context augmentation.

s416
00:38:41.280 --> 00:38:49.920
As I mentioned earlier, this fetches relevant context rules architecture from your project and feeds that into the agent.

s417
00:38:49.920 --> 00:38:53.040
Now, I have no idea how long this may take to work.

s418
00:38:53.040 --> 00:38:57.040
I imagine within less than a few uh minutes.

s419
00:38:57.040 --> 00:38:59.520
Normally, it's seconds.

s420
00:38:59.520 --> 00:39:10.640
Um however what I want you to realize as well is that using this is the full cycle all within the terminal as we are guiding the agent.

s421
00:39:10.640 --> 00:39:12.960
Oh look it finishes very quickly.

s422
00:39:12.960 --> 00:39:14.480
Very well done.

s423
00:39:14.480 --> 00:39:20.000
um is we we um get relevant context.

s424
00:39:20.000 --> 00:39:29.200
Um we you we get this to be fixed or implemented in this case when we're asking it to implement a new uh feature.

s425
00:39:29.200 --> 00:39:41.520
It gets verified from the uh agentic analysis hook and if there were any issues in there uh they would be flagged and Codex would continue to iterate until it is remediated.

s426
00:39:41.520 --> 00:39:47.680
So that's how we're getting that guide, verify, and solve uh methodology in here.

s427
00:39:47.680 --> 00:39:51.680
All right, I'm not going to spend any more time in the terminal.

s428
00:39:51.680 --> 00:39:56.960
Um this again is available for you to work on uh at your own leisure.

s429
00:39:56.960 --> 00:40:04.000
Uh there's a couple more things in there that you can do like um go ahead and track down some of the remaining issues.

s430
00:40:04.000 --> 00:40:22.960
Um if your org has entitlement for context augmentation and energetic analysis uh using that a little bit um but we are able to see that secrets get blocked right we can do find and fix on issues that exist and then new tasks that we're having it do

s431
00:40:22.960 --> 00:40:39.280
uh have a much stricter verification layer wrapped around it and thank you very much for waiting through some of the network connectivity issues with this um I want to say that we at Sonar have a booth downstairs.

s432
00:40:39.280 --> 00:40:42.800
I would love uh to come and talk to any of you guys.

s433
00:40:42.800 --> 00:40:47.359
Would love to chat about either AI related coding or anything outside of that.

s434
00:40:47.359 --> 00:40:50.800
Uh feel more than free to come out and say hi to us.

s435
00:40:50.800 --> 00:40:57.359
We have swag, we have guitar hero, we are we are um having a party down there.

s436
00:40:57.359 --> 00:41:05.280
Um, our uh community that we have, our sonar community, I believe it's community.

s437
00:41:05.280 --> 00:41:09.280
Is a great resource if you get stuck working through the repo at all in your own time.

s438
00:41:09.280 --> 00:41:19.599
Um, that is where our engineers who build the product are able to answer questions and and help people along um who who run into issues.

s439
00:41:19.599 --> 00:41:24.880
But thank you very much for uh listening and working along with me.

s440
00:41:24.880 --> 00:41:30.960
And if you guys have any questions, uh, feel free to come up or raise your hand and we can work through that.

s441
00:41:30.960 --> 00:41:33.040
Well, again, thank you very much for coming.

s442
00:41:33.040 --> 00:41:38.640
My name is Killian, uh, with Sonar and, uh, I hope to see you down at the booth.

s443
00:41:38.640 --> 00:41:39.508
Appreciate it.

s444
00:41:39.508 --> 00:41:41.508
[applause]

s445
00:41:54.573 --> 00:41:56.573
[music]