Code Security in the AI Era | SAST, SCA & Secrets Detection
summary
Claims a research set of 8 billion lines, 1 million developers, 40,000 orgs finds ~400 million issues — about one issue every 800 LOC (≈1–2 security issues per developer per month). Presents SonarQube-style SAST with symbolic execution and taint analysis, secret detection/prevention (CLI, commit-hook, 450 secret patterns / 10,000 APIs), SCA with malicious package detection and SBOM output, and demos showing prompt-injection tracing and an agentic reachability run that surfaces 7 IDORs plus zero-day finds. Reported accuracy: ~2% false positives, 95% Java / 87% Python detection.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:17Code Security in the AI Era
- 0:43The State of Code Security Today
- 2:04Why AI Increases Security Risk
- 3:03Rising Compliance Pressure in Software Security
- 4:35Sonar’s Verification Layer Approach
- 6:26Why Accuracy Matters in Security Tools
- 8:11Core Security Analysis Capabilities
- 10:21Demo: Tracing a Prompt Injection Flaw
- 12:38Secret Detection and Prevention
- 15:13Software Composition Analysis in Action
- 17:17Sneak Peek: Reachability and AI Analysis
- 20:16Summary: Secure Code Through Fast Verification
related talks
32mCode Security Reinvented: Navigating the Era of AI
41mCode Security Reinvented Navigating the era of AI
38mCode Security Reinvented: Navigating the era of AI
53mFlipping the Script on Application Security
19mFlipping the script on application security
33mSecurity as Code: A DevSecOps Approach
20mAI-Driven Security as Code in Jenkins
57mQuantifiable Quality: The New Standard of Secure Code