DeepCode, a SAST tool bug finder based on machine learning, can now be used seamlessly from within IntelliJ, PyCharm, and WebStorm.
There’s a lot of interest lately on Static Application Security Testing (SAST) Tools, and that has to do with the fact that the software written today is very complex and very large – a simple code review by humans won’t cut it anymore. Thus the introduction of SAST tools into the CI/CD pipeline and more specifically at the Commit-time and Test-time check phases.
Still there’s no IDE integration for SemGrep at this time, unlike DeepCode. Kay Ewbank gave us the lowdown on it in DeepCode Gets Cash And Opens Free Tier:
DeepCode is an AI -based tool that integrates with code hosting platforms including GitHub, Bitbucket Server and GitLab. It can be used to carry out an AI QA audit, analyzing any branch of your repositories to see the analysis results in your browser. You can also carry out a commit analysis that analyzes all your commits and comments on them to see if a commit introduces any new issues. The final option is a pull request analysis that does the same thing for pull requests.
The same report noted:
“The system is based on machine learning and aims to understand the intention of your code”.
By installing the extension from the JetBrains marketplace, you get DeepCode’s analysis of your code whenever you press Save from within your IDE. This is promised to:
“identify 10x more critical bugs and security vulnerabilities than other tools”
since, as our previous report pointed out, DeepCode’s analysis understands the intention of your code through the use of ML.
Installation with usage instructions can be found on its GitHub repo. Now get bug crushing!