How Freshworks Scales Shift-Left Security with SonarQube
summary
Freshworks embeds SonarQube into CI templates and IDEs so every pull request gets real‑time quality, vulnerability and secrets checks, reducing onboarding from days to hours and validating changes across 1,500+ developers and 2,000+ repos. An AI CodeFix feature generates contextual remediation suggestions in the workflow, cutting lead time, raising deployment success and lowering change‑failure rates and post‑release defects. Platform guardrails and portfolio dashboards give leadership audit‑ready visibility and measurable adoption.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 0:17Welcome and Freshworks DevOps Platform Team
- 0:46Freshworks Platform Overview and Engineering Scale
- 1:40Platform Role: CI/CD Pipelines, Kubernetes, and Governance
- 2:03Moving to a Paved-Path Developer Platform
- 2:28Making Code Quality the Platform Default at Scale
- 2:45Improving Developer Productivity with AI Coding Copilots
- 3:44Developer Buy-In for Platform Guardrails and Standards
- 4:06Making the Secure Path the Easiest Path for Developers
- 4:41Embedding Sonar Code Analysis in Standard CI Templates
- 5:06Secrets Detection and Early Security Checks in CI/CD
- 5:23AI Code Quality Assurance and Portfolio Visibility
- 6:14AI CodeFix: Contextual Code Remediation in the Developer Workflow
- 6:38Outcomes: Faster Code Validation and Fewer Software Defects
- 7:07Shifting Security Earlier in the Developer Workflow
- 7:42Developer-First Onboarding with Preconfigured Sonar Setup
- 8:32Pull Request Feedback Loops: Why They Matter and How to Fix Issues
- 9:07Leadership and Business Units Consuming Engineering Metrics
- 9:41Engineering KPIs Reported to Leadership
- 9:51Key Metrics: Platform Adoption, Developer Velocity, Business Confidence
- 11:01Velocity Metrics: Lead Time, Deployment Frequency, Change Failure Rate
- 12:06Business Metrics: Release Visibility and Audit-Ready Traceability
- 13:11AI Adoption: Coding Tools and Quality Control Practices
- 13:42AI Developer Tools: Cursor, GitHub Copilot, and More
- 14:44Intelligent Scale: Automated Code Validation and Guided Remediation
- 16:07Platform Guardrails vs AI Adoption Sequencing
- 16:32Parallel Rollout of Guardrails with New AI Platform Features
- 17:49Tracking AI Usage Signals and Developer Improvement Areas
- 19:24Internal AI Agents for Code Review and Implementation
- 20:02Guardrails Increasing Confidence in Shipping AI-Generated Code
- 21:17Closing: Treating Code Quality as a Platform Capability
related talks
45mHow Leading Companies Are Scaling Their Security
19mApplication Security at High Velocity
42mContinuous Security: Integrate security tools into your DevOps Pipeline
11mLove Your Security Engineer as Yourself
43mBuilding and deploying secure apps by “shifting left”
47mRollercoaster of Security Automation
37mBuilding Developer-Centric APIs in a Multi-Product SaaS Org
57mDev-first security: From code to cloud, and back to code (PRT291)